CVE-2014-2684 Auth bypass in n/a
Remote attackers can bypass authentication and spoof OpenID identities by exploiting a lack of endpoint verification in the Zend OpenID consumer library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-2684?
CVE-2014-2684 is a medium-severity authentication bypass vulnerability in n/a, published on 16 Nov 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values.
Weakness: CWE-264
Which versions are affected by CVE-2014-2684?
It affects 2 products.
Products include Zend Zend Framework, Zend Zendopenid.
How do I fix CVE-2014-2684?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2014-2684 being exploited?
There is no known exploitation of CVE-2014-2684 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hwqj-6cj6-j4c3.