Lucene search
Ubuntu.comUB:CVE-2014-2685HistorySep 04, 2014 - 12:00 a.m.
CVE-2014-2685
2014-09-0400:00:00
ubuntu.com
ubuntu.com
8
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.016 Low
EPSS
Percentile
87.0%
The GenericConsumer class in the Consumer component in ZendOpenId before
2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4
violate the OpenID 2.0 protocol by ensuring only that at least one field is
signed, which allows remote attackers to bypass authentication by
leveraging an assertion from an OpenID provider.
Bugs
Related
prion
prion
Authentication flaw
2014-09-04 17:55:00
veracode
veracode
Authentication Bypass
2017-07-30 23:11:29
cve
cve
CVE-2014-2685
2014-09-04 17:55:00
nessus
nessus
Zend Framework < 1.12.4 Multiple Vulnerabilities
2016-03-15 00:00:00
Fedora 20 : php-ZendFramework2-2.2.6-1.fc20 (2014-4612)
2014-04-15 00:00:00
Fedora 19 : php-ZendFramework-1.12.5-1.fc19 (2014-4603)
2014-04-15 00:00:00
openvas
openvas
Amazon Linux: Security Advisory (ALAS-2014-377)
2015-09-08 00:00:00
Fedora Update for php-ZendFramework FEDORA-2014-4603
2014-04-15 00:00:00
Fedora Update for php-ZendFramework2 FEDORA-2014-4612
2014-04-15 00:00:00
mageia
mageia
Updated php-ZendFramework packages fix multiple vulnerabilities
2014-04-03 04:43:46
fedora
fedora
[SECURITY] Fedora 20 Update: php-ZendFramework-1.12.5-1.fc20
2014-04-14 22:36:10
[SECURITY] Fedora 20 Update: php-ZendFramework2-2.2.7-1.fc20
2014-05-28 23:52:16
[SECURITY] Fedora 19 Update: php-ZendFramework2-2.2.6-1.fc19
2014-04-14 22:40:52
securityvulns
securityvulns
[ MDVSA-2014:072 ] php-ZendFramework
2014-05-05 00:00:00
[ MDVSA-2015:097 ] php-ZendFramework
2015-05-12 00:00:00
[SECURITY] [DSA 3265-1] zendframework security update
2015-06-08 00:00:00
amazon
amazon
Important: php-ZendFramework
2014-07-23 13:39:00
osv
osv
zendframework - security update
2015-05-20 00:00:00
zendframework - regression update
2015-05-20 00:00:00
zendframework - security update
2015-06-23 00:00:00
debian
debian
[SECURITY] [DSA 3265-1] zendframework security update
2015-05-20 09:37:25
[SECURITY] [DSA 3265-2] zendframework regression update
2015-05-24 11:55:24
[SECURITY] [DLA 251-1] zendframework security update
2015-06-20 18:40:57
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.016 Low
EPSS
Percentile
87.0%
Related for UB:CVE-2014-2685