cbcvebase.
CVE-2014-2685
published 2014-09-04

CVE-2014-2685: The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the…

PriorityP348high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
2.80%
84.7th percentile
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Affected

66 ranges· showing 25
VendorProductVersion rangeFixed in
zendzend_framework<= 1.12.3—
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
zendzend_framework——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.