CVE-2014-2294

Опубликовано: 17 апр. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.

Ссылки

http://karmainsecurity.com/KIS-2014-03
Third Party Advisory
http://www.openwebanalytics.com/?p=388
Patch
Release Notes
Vendor Advisory
https://secuniaresearch.flexerasoftware.com/advisories/56999
Permissions Required
https://secuniaresearch.flexerasoftware.com/secunia_research/2014-3/
Third Party Advisory
https://www.securityfocus.com/bid/66076
Third Party Advisory
VDB Entry
http://karmainsecurity.com/KIS-2014-03
Third Party Advisory
http://www.openwebanalytics.com/?p=388
Patch
Release Notes
Vendor Advisory
https://secuniaresearch.flexerasoftware.com/advisories/56999
Permissions Required
https://secuniaresearch.flexerasoftware.com/secunia_research/2014-3/
Third Party Advisory
https://www.securityfocus.com/bid/66076
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:openwebanalytics:open_web_analytics:*:*:*:*:*:*:*:*

Версия до 1.5.7 (исключая)

EPSS

Процентиль: 89%

0.04677

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-74

Связанные уязвимости

GHSA-63pj-fqcx-mcvc