CVE-2014-5376

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-10-08 · updated 2026-06-17
Weakness: CWE-20

Description

Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, when a pre-generated key is used, does not validate that the requesting user matches the actor in the message, which allows remote authenticated users to impersonate arbitrary users via the actor field in a message.

Affected products

Adaptivecomputing Moab: through 7.2.8; 8.0

References

http://packetstormsecurity.com/files/128485/Moab-Insecure-Message-Signing-Authentication-Bypass.html
http://www.adaptivecomputing.com/security-advisory/
http://www.securityfocus.com/archive/1/533577/100/0/threaded
http://www.securityfocus.com/bid/70171
https://exchange.xforce.ibmcloud.com/vulnerabilities/96700
http://packetstormsecurity.com/files/128485/Moab-Insecure-Message-Signing-Authentication-Bypass.html
http://www.adaptivecomputing.com/security-advisory/
http://www.securityfocus.com/archive/1/533577/100/0/threaded
http://www.securityfocus.com/bid/70171
https://exchange.xforce.ibmcloud.com/vulnerabilities/96700

Get alerted when CVE-2014-5376 or the next vulnerability affects your stack