Description

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Remediation

References

CVE-2010-3091

Related Vulnerabilities

WordPress 5.1.x Multiple Vulnerabilities (5.1 - 5.1.17)

WordPress 3.8.x Multiple Vulnerabilities (3.8 - 3.8.29)

Drupal CVE-2018-14773 Vulnerability (CVE-2018-14773)

WordPress Plugin Redux Framework Multiple Vulnerabilities (4.2.11)

Oracle JRE CVE-2013-2472 Vulnerability (CVE-2013-2472)

Severity

Medium

Classification

CVE-2010-3091 CWE-287

Tags

Missing Update Known Vulnerabilities