Description

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Remediation

References

CVE-2010-3686

Related Vulnerabilities

RubyGems Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-8322)

WordPress Plugin All in One SEO-Best WordPress SEO-Easily Improve SEO Rankings & Increase Traffic Cross-Site Scripting (2.2.2)

Drupal Core 8.x.x Cross-Site Request Forgery (8.0.0 - 8.8.12)

Nginx Uncontrolled Resource Consumption Vulnerability (CVE-2018-16844)

TinyMCE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-29881)

Severity

Medium

Classification

CVE-2010-3686 CWE-287

Tags

Missing Update Known Vulnerabilities