CVE-2014-1457

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-03-20 · updated 2026-06-17
Weakness: CWE-352

Description

Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanism by leveraging knowledge of an OWA user name.

Affected products

openwebanalytics Open Web Analytics: before 1.5.6 — fixed in 1.5.6

How to fix

Upgrade to a fixed version: openwebanalytics Open Web Analytics 1.5.6. Check the vendor advisory for mitigations.

References

http://www.openwebanalytics.com/?p=384
http://www.securityfocus.com/bid/65573
https://exchange.xforce.ibmcloud.com/vulnerabilities/91125
https://www.secureworks.com/research/swrx-2014-006
http://www.openwebanalytics.com/?p=384
http://www.securityfocus.com/bid/65573
https://exchange.xforce.ibmcloud.com/vulnerabilities/91125
https://www.secureworks.com/research/swrx-2014-006

Get alerted when CVE-2014-1457 or the next vulnerability affects your stack