{"id":"CVE-2014-8686","title":"CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption sch","published":"2017-09-19T15:29:00.263Z","updated":"2026-06-16T20:17:10.670Z","severity":"critical","cvssScore":9.8,"epss":0.37222,"epssPct":0.98543,"kev":false,"maturity":"weaponized","actionScore":60,"primaryVendor":"codeigniter","primaryProduct":"codeigniter","cweId":"CWE-310","fixAvailable":false,"tags":["pre-auth","remote","no-ui"],"epssDelta7":0,"summary":"CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.0","cvssSource":"nvd-primary","cweName":"Cryptographic Issues","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-06T13:26:02.447Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:47:54.670Z","exploitdb":"2026-11-13T03:17:58.683Z","metasploit":"2026-11-13T03:18:09.107Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":1,"metasploit":1,"nuclei":0,"githubPoc":0},"products":[{"vendor":"codeigniter","product":"codeigniter","cpe":"cpe:2.3:a:codeigniter:codeigniter"}],"references":[{"url":"https://codeigniter.com/userguide2/changelog.html","tags":"Vendor Advisory"},{"url":"https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability","tags":"Third Party Advisory"}],"exploits":[{"source":"exploitdb","kind":"remote","date":"2015-03-04"},{"source":"metasploit","kind":"exploit","date":"2015-03-01"}],"analysis":null,"affectedVersions":[{"vendor":"codeigniter","product":"codeigniter","version":"*","vsi":null,"vse":null,"vei":"2.1.4","vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}