Description

The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.

Remediation

References

CVE-2015-3234

Related Vulnerabilities

WordPress Plugin AccessPress Social Icons Multiple SQL Injection Vulnerabilities (1.6.6)

MySQL CVE-2018-3280 Vulnerability (CVE-2018-3280)

WordPress Plugin Article Directory Redux Cross-Site Scripting (1.0.2)

WordPress Plugin PayPlus Payment Gateway SQL Injection (7.0.7)

Oracle JRE CVE-2013-2418 Vulnerability (CVE-2013-2418)

Severity

Medium

Classification

CVE-2015-3234 CWE-20

Tags

Missing Update Known Vulnerabilities