Vulnerability Description
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zend | Zend Framework | <= 1.12.3 |
| Zend | Zendopenid | <= 2.0.1 |
Related Weaknesses (CWE)
References
- http://advisories.mageia.org/MGASA-2014-0151.html
- http://framework.zend.com/security/advisory/ZF2014-02Vendor Advisory
- http://seclists.org/oss-sec/2014/q2/0
- http://www.debian.org/security/2015/dsa-3265
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:072
- http://www.securityfocus.com/bid/66358
- http://advisories.mageia.org/MGASA-2014-0151.html
- http://framework.zend.com/security/advisory/ZF2014-02Vendor Advisory
- http://seclists.org/oss-sec/2014/q2/0
- http://www.debian.org/security/2015/dsa-3265
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:072
- http://www.securityfocus.com/bid/66358
FAQ
What is CVE-2014-2685?
CVE-2014-2685 is a vulnerability with a CVSS score of 7.5 (HIGH). The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only tha...
How severe is CVE-2014-2685?
CVE-2014-2685 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-2685?
Check the references section above for vendor advisories and patch information. Affected products include: Zend Zend Framework, Zend Zendopenid.