What is the CVSS score of CVE-2014-2684?

CVE-2014-2684 has a CVSS 2.0 base score of 6.4 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.6%.

Zendopenid CVE-2014-2684

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2014-11-16 cve@mitre.org

Privilege Escalation Zendopenid Zend Framework

6.4

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Nov 16, 2014 - 00:59 cve.org

MEDIUM 6.4

DescriptionCVE.org

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values.

AnalysisAI

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values. Affected products include: Zend Zendopenid, Zend Zend Framework. Version information: before 2.0.2.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.