CVE-2013-5350

{"id": "CVE-2013-5350", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-01-24T15:08:00.653", "references": [{"url": "http://jvn.jp/en/jp/JVN69986880/index.html", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000009", "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://secunia.com/advisories/54043", "tags": ["Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://secunia.com/secunia_research/2014-1/", "tags": ["Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "https://www.openpne.jp/archives/12293/", "tags": ["Vendor Advisory"], "source": "PSIRT-CNA@flexerasoftware.com"}, {"url": "http://jvn.jp/en/jp/JVN69986880/index.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000009", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/54043", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/secunia_research/2014-1/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.openpne.jp/archives/12293/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The \"Remember me\" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object injection attacks, and execute arbitrary PHP code, via a crafted serialized object."}, {"lang": "es", "value": "La funcionalidad \"Remember me\" en la funci\u00f3n opSecurityUser::getRememberLoginCookie en lib/user/opSecurityUser.class.php en OpenPNE 3.6.13 anteriores a 3.6.13.1 y 3.8.9 anteriores a 3.8.9.1 no valida correctamente los datos de login en las cabeceras HTTP Cookie, lo cual permite a atacantes remotos efectuar ataques de inyecci\u00f3n de objetos PHP, y ejecutar c\u00f3digo PHP arbitrario, a trav\u00e9s de un objeto serializado manipulado."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:tejimaya:openpne:3.6.13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47631DE1-EF45-4251-82A8-0C616A7DFB71"}, {"criteria": "cpe:2.3:a:tejimaya:openpne:3.8.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69E048BB-7CCE-435D-BA5C-228ABB1BC48D"}], "operator": "OR"}]}], "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"}