CVE-2014-8684

CodeIgniter and Kohana vulnerable to PHP Object Injection

9.8 CriticalPublic exploitFix available

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

72.2%Up 70.9 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2014-8684
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-8684
Updated: 2026-11-02

EUVDEUVD-2022-5542 No score

Record: EUVD-2022-5542
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w9ph-q4h9-rwq6 9.8

CodeIgniter and Kohana vulnerable to PHP Object Injection

Record: GHSA-w9ph-q4h9-rwq6
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-w9ph-q4h9-rwq6 9.8

CodeIgniter and Kohana vulnerable to PHP Object Injection

Record: GHSA-w9ph-q4h9-rwq6
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`codeigniter/framework` Packagist	before 3.0.0	3.0.0
`kohana/core` Packagist	before 3.3.3	3.3.3
`codeigniter/framework` Packagist	before 3.0.0, plus listed versions 3.0rc3.0rc23.0rc3	3.0.0
`kohana/core` Packagist	before 3.3.3, plus listed versions v3.2.3v3.3.1v3.3.2	3.3.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Seagate Business NAS - Remote Command Execution (Metasploit)	2015-03-04
Metasploit	Seagate Business NAS Unauthenticated Remote Command Execution	2015-03-01

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-8684 is a critical vulnerability (CVSS 9.8) in Codeigniter, published September 19, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 72.2%, the 99th percentile. Fixed in codeigniter/framework 3.0.0.