CVE-2014-2875

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2014/Apr/318Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/531981/100/0/threadedThird Party Advisory, VDB Entry
http://www.syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionidThird Party Advisory
http://seclists.org/fulldisclosure/2014/Apr/318Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/531981/100/0/threadedThird Party Advisory, VDB Entry
http://www.syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionidThird Party Advisory

Timeline

Published: Feb 6, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-28794.3Multiple cross-site scripting (XSS) vulnerabilities in Dell SonicWALL Email Security 7.4.5 and earlier allow remote authenticated administra CVE-2014-28805.8Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 CVE-2014-288110.0Unspecified vulnerability in the Diffie-Hellman key agreement implementation in the management GUI Java applet in Citrix NetScaler Applicati CVE-2014-288210.0Unspecified vulnerability in the management GUI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 9.3-6 CVE-2014-28843.3The ProcessVolumeDeviceControlIrp function in Ntdriver.c in TrueCrypt 7.1a allows local users to bypass access restrictions and obtain sensi CVE-2014-28857.1Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->Ori CVE-2014-28866.8GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute CVE-2014-28887.5lib/sfpagent/bsig.rb in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacte CVE-2014-28894.6Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, a CVE-2014-28904.3Cross-site scripting (XSS) vulnerability in the wrap_html function in MyID.php in phpMyID 0.9 allows remote attackers to inject arbitrary we CVE-2014-28915.0strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted I CVE-2014-28927.5Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via