Vulnerabilities > CVE-2014-2595 - Insufficient Session Expiration vulnerability in Barracuda web Application Firewall 7.8.1.013
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Common Weakness Enumeration (CWE)
Exploit-Db
| description | Barracuda Web Application Firewall Authentication Bypass Vulnerability. CVE-2014-2595. Remote exploit for hardware platform |
| id | EDB-ID:39278 |
| last seen | 2016-02-04 |
| modified | 2014-08-04 |
| published | 2014-08-04 |
| reporter | Nick Hayes |
| source | https://www.exploit-db.com/download/39278/ |
| title | Barracuda Web Application Firewall Authentication Bypass Vulnerability |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/127740/barracuda-bypass.txt |
| id | PACKETSTORM:127740 |
| last seen | 2016-12-05 |
| published | 2014-08-04 |
| reporter | Nick Hayes |
| source | https://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html |
| title | Barracuda WAF Authentication Bypass |
References
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2595/
- http://www.osvdb.org/109782
- https://vulners.com/securityvulns/SECURITYVULNS:DOC:31004
- http://packetstormsecurity.com/files/127740/Barracuda-WAF-Authentication-Bypass.html
- https://www.exploit-db.com/exploits/39278
- http://seclists.org/fulldisclosure/2014/Aug/5
- https://www.securityfocus.com/bid/69028