CVE-2014-6029: Input Validation
Published Sep 5, 2014
·Updated
TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an editCookies action to profile.php.
Affected Software
1 affected component
Torrentflux Project Torrentflux=2.4
Event History
Sep 5, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-6029?
CVE-2014-6029 is considered a moderate severity vulnerability as it allows authenticated users to manipulate cookies of other users.
2
How do I fix CVE-2014-6029?
To fix CVE-2014-6029, upgrade to the latest version of TorrentFlux or apply appropriate access controls to restrict user actions.
3
Who is affected by CVE-2014-6029?
CVE-2014-6029 affects all users of TorrentFlux version 2.4 who provide authenticated access.
4
What can attackers do with CVE-2014-6029?
Attackers exploiting CVE-2014-6029 can delete or modify the cookies of other authenticated users on the application.
5
Is user authentication required to exploit CVE-2014-6029?
Yes, CVE-2014-6029 requires that the attacker is an authenticated user of the TorrentFlux system.