CVE-2017-14143: The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie s...

Security readout for executives and security teams

CVE-2017-14143 is a Kaltura server flaw where a shared, hardcoded cookie secret weakened trust in userzone cookies. A remote attacker could forge a valid-looking cookie, bypass the intended signature protection, and reach PHP object injection that may lead to arbitrary PHP code execution. Exposure is most likely on internet-accessible Kaltura server deployments running versions before 13.2.0. The source bundle does not provide CPEs, package names, deployment prerequisites, or whether all configurations are reachable by default. Prioritize remediation if Kaltura is internet-facing or handles sensitive media workflows. The risk is high because the stated impact includes remote arbitrary PHP code execution, though active exploitation is not confirmed in the provided sources. Mitigation focus: Upgrade affected Kaltura deployments to 13.2.0 or later.; Review the referenced Kaltura commit and Telekom advisory for vendor-specific remediation details.; Restrict internet exposure to Kaltura administrative and application endpoints where business permits..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.