CVE-2024-34914 PHP Censor uses a weak hashing algorithm for the remember me key
Weak hashing in php-censor allows attackers to brute-force remember keys and take over accounts of users who selected remember me.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-34914?
CVE-2024-34914 is a medium-severity vulnerability in n/a, published on 14 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
php-censor v2.1.4 and fixed in v.2.1.5 was discovered to utilize a weak hashing algorithm for its remember_key value. This allows attackers to bruteforce to bruteforce the remember_key value to gain access to accounts that have checked "remember me" when logging in.
Weakness: CWE-328
Which versions are affected by CVE-2024-34914?
4 open source packages ship an affected version, including php-censor/php-censor.
| Package | Affected | Fixed in |
|---|---|---|
php-censor/php-censor Packagist | All versions | 2.0.13 |
php-censor/php-censor Packagist | All versions | 2.0.13 |
php-censor/php-censor Packagist | From 2.1.0 | 2.1.5 |
php-censor/php-censor Packagist | From 2.1.0 | 2.1.5 |
How do I fix CVE-2024-34914?
Upgrade php-censor/php-censor to a fixed version for your release line: 2.0.13 or 2.1.5.
Is CVE-2024-34914 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34914 exists.
Sources
Also known as GHSA-fqw7-839j-hvxj.