Description

The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.

Remediation

References

CVE-2015-3234

Related Vulnerabilities

WordPress Plugin WP Athletics SQL Injection (1.1.7)

WebLogic CVE-2022-21453 Vulnerability (CVE-2022-21453)

OpenSSL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2015-0292)

Oracle Application Server CVE-2006-3713 Vulnerability (CVE-2006-3713)

MySQL CVE-2018-3171 Vulnerability (CVE-2018-3171)

Severity

Medium

Classification

CVE-2015-3234 CWE-20

Tags

Missing Update Known Vulnerabilities