CVE-2014-2685 — Improper Authentication in Framework

CWE-287 — Improper Authentication4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 25.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Zend FrameworkZend Zendopenid
Timeline
PublishedSep 4
Latest updateMay 17

Description

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶NVDzend/zendopenid2.0.1
▶NVDzend/zend_framework1.12.3+64

🔴Vulnerability Details

2
GHSA
GHSA-jh3g-pqch-xqxg: The GenericConsumer class in the Consumer component in ZendOpenId before 2↗2022-05-17
▶
CVEList
CVE-2014-2685: The GenericConsumer class in the Consumer component in ZendOpenId before 2↗2014-09-04
▶

💬Community

1
Bugzilla
CVE-2014-2684 CVE-2014-2685 php-ZendFramework: OpenID identity provider could be used to spoof other identity providers (ZF2014-02)↗2014-03-27
▶
CVE-2014-2685 — Improper Authentication in Framework | cvebase