CVEvulnerability

CVE-2010-3685

5.0 MEDIUM Published 2010-09-29 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-09-29
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-287

Description

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Affected configurations

• drupal drupal 6.0 • drupal drupal 6.1 • drupal drupal 6.2 • drupal drupal 6.3 • drupal drupal 6.4 • drupal drupal 6.5 • drupal drupal 6.6 • drupal drupal 6.7 • drupal drupal 6.8 • drupal drupal 6.9 • drupal drupal 6.10 • drupal drupal 6.11 • drupal drupal 6.12 • drupal drupal 6.13 • drupal drupal 6.14 • drupal drupal 6.15 • drupal drupal 6.16 • drupal drupal 6.17 • peter wolanin openid 5.x-1.0 • peter wolanin openid 5.x-1.1 • peter wolanin openid 5.x-1.2 • peter wolanin openid 5.x-1.3 • peter wolanin openid 5.x-1.x

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References