CVE-2014-2684: Medium severity zend openid vulnerability
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the ZendOpenIdConsumer class in Zend Framework 1 before 1.12.4 does not verify that the openidopendpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimedid values.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2684?
CVE-2014-2684 is considered a moderate severity vulnerability due to its potential for identity provider spoofing.
How do I fix CVE-2014-2684?
To fix CVE-2014-2684, upgrade ZendOpenId to version 2.0.2 or later, and update Zend Framework to version 1.12.4 or later.
What type of vulnerability is CVE-2014-2684?
CVE-2014-2684 is an identity verification vulnerability that affects openid_op_endpoint value checks.
Which versions of Zend Framework are impacted by CVE-2014-2684?
CVE-2014-2684 impacts versions of Zend Framework prior to 1.12.4.
Which versions of Zend OpenId are affected by CVE-2014-2684?
CVE-2014-2684 affects Zend OpenId versions before 2.0.2.