Lucene search
HistorySep 29, 2010 - 5:00 p.m.
CVE-2010-3686
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
AI Score
6.7
Confidence
High
EPSS
0.005
Percentile
75.9%
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Affected configurations
Node
drupaldrupalMatch6.0
ORdrupaldrupalMatch6.0beta1
ORdrupaldrupalMatch6.0beta2
ORdrupaldrupalMatch6.0beta3
ORdrupaldrupalMatch6.0beta4
ORdrupaldrupalMatch6.0dev
ORdrupaldrupalMatch6.0rc1
ORdrupaldrupalMatch6.0rc2
ORdrupaldrupalMatch6.0rc3
ORdrupaldrupalMatch6.0rc4
ORdrupaldrupalMatch6.1
ORdrupaldrupalMatch6.2
ORdrupaldrupalMatch6.3
ORdrupaldrupalMatch6.4
ORdrupaldrupalMatch6.5
ORdrupaldrupalMatch6.6
ORdrupaldrupalMatch6.7
ORdrupaldrupalMatch6.8
ORdrupaldrupalMatch6.9
ORdrupaldrupalMatch6.10
ORdrupaldrupalMatch6.11
ORdrupaldrupalMatch6.12
ORdrupaldrupalMatch6.13
ORdrupaldrupalMatch6.14
ORdrupaldrupalMatch6.15
ORdrupaldrupalMatch6.16
ORdrupaldrupalMatch6.17
Node
peter_wolaninopenidMatch5.x-1.0
ORpeter_wolaninopenidMatch5.x-1.1
ORpeter_wolaninopenidMatch5.x-1.2
ORpeter_wolaninopenidMatch5.x-1.3
ORpeter_wolaninopenidMatch5.x-1.xdev
Related
ubuntucve
ubuntucve
CVE-2010-3686
2010-09-29 00:00:00
cve
cve
CVE-2010-3686
2022-10-03 16:20:58
prion
prion
Authentication flaw
2010-09-29 17:00:00
cvelist
cvelist
CVE-2010-3686
2022-10-03 16:20:58
nessus
nessus
Debian DSA-2113-1 : drupal6 - several vulnerabilities
2010-09-21 00:00:00
openvas
openvas
Debian: Security Advisory (DSA-2113-1)
2010-10-10 00:00:00
debian
debian
[BSA-023] Security Update for drupal6
2011-01-25 16:43:46
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
AI Score
6.7
Confidence
High
EPSS
0.005
Percentile
75.9%
Related for NVD:CVE-2010-3686