CVE-2017-14143

CVE-2017-14143 is a critical vulnerability affecting Kaltura before version 13.2.0, stemming from the use of a hardcoded cookie secret in the getUserzoneCookie function. This flaw allows remote attackers to bypass security mechanisms, leading to PHP object injection and arbitrary PHP code execution. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity, potentially resulting in complete compromise of confidentiality, integrity, and availability. While not on the KEV catalog or actively exploited, public exploit code, including a Metasploit module, is available, and its high EPSS score indicates a significant likelihood of future exploitation.