CVE-2014-4168

2014-07-0317:55:06

CWE-287

[email protected]

web.nvd.nist.gov

iodine

authentication bypass

remote attack

cve-2014-4168

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.025 Low

EPSS

Percentile

90.3%

JSON

(1) iodined.c and (2) user.c in iodine before 0.7.0 allows remote attackers to bypass authentication by continuing execution after an error has been triggering.

Affected configurations

NVD

Node

kryoiodineRange≤0.6.0rc1

kryoiodineMatch0.3.0

kryoiodineMatch0.3.1

kryoiodineMatch0.3.2

kryoiodineMatch0.3.3

kryoiodineMatch0.3.4

kryoiodineMatch0.4.0

kryoiodineMatch0.4.1

kryoiodineMatch0.4.2

kryoiodineMatch0.5.0

kryoiodineMatch0.5.1

kryoiodineMatch0.5.2

CPENameOperatorVersion
kryo:iodinekryo iodinele0.6.0
kryo:iodinekryo iodineeq0.3.0
kryo:iodinekryo iodineeq0.3.1
kryo:iodinekryo iodineeq0.3.2
kryo:iodinekryo iodineeq0.3.3
kryo:iodinekryo iodineeq0.3.4
kryo:iodinekryo iodineeq0.4.0
kryo:iodinekryo iodineeq0.4.1
kryo:iodinekryo iodineeq0.4.2
kryo:iodinekryo iodineeq0.5.0

CPE	Name	Operator	Version
kryo:iodine	kryo iodine	le	0.6.0
kryo:iodine	kryo iodine	eq	0.3.0
kryo:iodine	kryo iodine	eq	0.3.1
kryo:iodine	kryo iodine	eq	0.3.2
kryo:iodine	kryo iodine	eq	0.3.3
kryo:iodine	kryo iodine	eq	0.3.4
kryo:iodine	kryo iodine	eq	0.4.0
kryo:iodine	kryo iodine	eq	0.4.1
kryo:iodine	kryo iodine	eq	0.4.2
kryo:iodine	kryo iodine	eq	0.5.0