Description

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Remediation

References

CVE-2010-3686

Related Vulnerabilities

WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-20151)

WordPress Plugin WP Prayer Cross-Site Scripting (1.6.1)

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-1948)

Coppermine Multiple Cross-site Scripting (XSS) Vulnerabilities (CVE-2015-6528)

WordPress Plugin Google Analytics Dashboard Cross-Site Scripting (2.1.1)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-287 CVE-2010-3686