CGILua 5.2 alpha 1/5.2 alpha 2 session.lua excessive authentication

Summaryinfo

A vulnerability identified as problematic has been detected in CGILua 5.2 alpha 1/5.2 alpha 2. Affected is an unknown function in the library session.lua. Performing a manipulation results in excessive authentication. This vulnerability is identified as CVE-2014-2875. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in CGILua 5.2 alpha 1/5.2 alpha 2. This affects some unknown functionality in the library session.lua. The manipulation with an unknown input leads to a excessive authentication vulnerability. CWE is classifying the issue as CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. This is going to have an impact on confidentiality. The summary by CVE is:

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID.

The weakness was released 04/21/2023. The advisory is shared at seclists.org. This vulnerability is uniquely identified as CVE-2014-2875 since 04/16/2014. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 254316 (Linux Distros Unpatched Vulnerability : CVE-2014-2875), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (254316). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• CGILua

Version

• 5.2 alpha 1
• 5.2 alpha 2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion