Vulnerabilities > CVE-2014-2875 - Improper Restriction of Excessive Authentication Attempts vulnerability in Keplerproject Cgilua

047910
CVSS 6.1 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
LOW
Integrity impact
LOW
Availability impact
NONE
network
low complexity
keplerproject
CWE-307
NVD
Published: 2020-02-06
Updated: 2024-11-21

Summary

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID.

Vulnerable Configurations

Part Description Count
Application
Keplerproject
6

Common Weakness Enumeration (CWE)

References