Description

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Remediation

References

CVE-2010-3686

Related Vulnerabilities

WordPress Plugin WooCommerce Help Scout Arbitrary File Upload (2.9)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-12645)

WordPress 4.5.x Multiple Vulnerabilities (4.5 - 4.5.4)

WordPress Plugin Download Manager Cross-Site Scripting (3.2.42)

Ruby on Rails Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-1855)

Severity

Medium

Classification

CVE-2010-3686 CWE-287

Tags

Missing Update Known Vulnerabilities