Critical severity · published Sep 19, 2017
CVE-2014-8684
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object…
9.8
CVSS
72.2%
EPSS
No
On KEV
Description
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)72.2% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Codeigniter · Codeigniter
through 2.2.6 · source: NVD
KO
Kohana · Kohanaframework
3.2.3; 3.3.0; 3.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-8684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-8684
Third Party Advisory
http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
Mailing List
http://seclists.org/fulldisclosure/2014/May/54
Third Party Advisory
https://github.com/kohana/core/pull/492
Third Party Advisory
https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
More from Codeigniter
9.8
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
9.8
CVE-2023-32692
CodeIgniter is a PHP full-stack web framework
9.8
CVE-2022-46170
CodeIgniter is a PHP full-stack web framework
9.8
CVE-2022-40834
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have…
9.8
CVE-2022-40824
B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have…