CVE-2014-2875 in CGILua

Summary

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Reservation: 04/16/2014
• Moderation: VulDB entry created
• Entries: 1: VDB-227061
• CPE: ready
• CWE: CWE-307 (Confirmed)
• CVSS: 5.2
• EPSS: 0.00573
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2014-2875
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-2875
• CVE Details: https://www.cvedetails.com/cve/CVE-2014-2875/