Vulnerabilities > CVE-2014-2875 - Improper Restriction of Excessive Authentication Attempts vulnerability in Keplerproject Cgilua
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
NONE Integrity impact
PARTIAL Availability impact
NONE Summary
The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 6 |