CVE-2014-8686 affects CodeIgniter versions prior to 2.2.0, allowing attackers to more easily decode session cookies due to a weak, XOR-based encryption fallback when the Mcrypt PHP extension is unavailable. This vulnerability is rated as Critical with a CVSS score of 9.8, indicating an easily exploitable network-based attack that can lead to complete compromise of confidentiality, integrity, and availability. While not on the KEV catalog, exploit intelligence shows a Metasploit module exists, and it has garnered significant community discussion and media coverage, suggesting a high potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.1.4CPE matchmatch criteria | cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.