CVE-2014-2685 Auth bypass in n/a

What is CVE-2014-2685?

CVE-2014-2685 is a high-severity authentication bypass vulnerability in n/a, published on 4 Sep 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Weakness: CWE-287

Which versions are affected by CVE-2014-2685?

It affects 2 products.

Products include Zend Zend Framework, Zend Zendopenid.

How do I fix CVE-2014-2685?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2014-2685 being exploited?

There is no known exploitation of CVE-2014-2685 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-29312 Deserialization in n/a Critical 9.8
• CVE-2015-1555 Auth bypass in n/a Critical 9.1
• CVE-2015-1786 Zend Framework CSRF Vulnerability High 8.8
• CVE-2015-7503 Zend Framework Information Disclosure High 7.5
• CVE-2015-5161 ZendXml and Zend Framework contain XXE and XEE Vulnerabilities Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jh3g-pqch-xqxg.