CVEvulnerability

CVE-2010-3686

5.0 MEDIUM Published 2010-09-29 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-09-29
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
CWE-287

Description

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Affected configurations

• drupal drupal 6.0 • drupal drupal 6.1 • drupal drupal 6.2 • drupal drupal 6.3 • drupal drupal 6.4 • drupal drupal 6.5 • drupal drupal 6.6 • drupal drupal 6.7 • drupal drupal 6.8 • drupal drupal 6.9 • drupal drupal 6.10 • drupal drupal 6.11 • drupal drupal 6.12 • drupal drupal 6.13 • drupal drupal 6.14 • drupal drupal 6.15 • drupal drupal 6.16 • drupal drupal 6.17 • peter wolanin openid 5.x-1.0 • peter wolanin openid 5.x-1.1 • peter wolanin openid 5.x-1.2 • peter wolanin openid 5.x-1.3 • peter wolanin openid 5.x-1.x

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References