Description

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Remediation

References

CVE-2010-3686

Related Vulnerabilities

WordPress Plugin Easy PayPal Events Cross-Site Scripting (1.1.1)

PHP Numeric Errors Vulnerability (CVE-2011-1092)

Drupal Core 7.x Multiple Vulnerabilities (7.0 - 7.34)

WordPress Plugin PowerPack Lite for Beaver Builder Cross-Site Scripting (1.2.9.2)

MySQL CVE-2013-3795 Vulnerability (CVE-2013-3795)

Severity

Medium

Classification

CVE-2010-3686 CWE-287

Tags

Missing Update Known Vulnerabilities