NVD

Id
15043  
Name
CVE-2010-3686  
Description
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-18  
Published
2010-09-29  
Modified Date
2010-09-30  
Seq
2010-3686  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
84019 15043 CVE-2010-3686 http://drupal.org/node/880476  View
84020 15043 CVE-2010-3686 http://drupal.org/node/880480  View
84021 15043 CVE-2010-3686 [oss-security] 20100911 CVE id requests: drupal  View
84022 15043 CVE-2010-3686 [oss-security] 20100913 Re: CVE id requests: drupal  View
84023 15043 CVE-2010-3686 DSA-2113  View
84024 15043 CVE-2010-3686 42388  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36332 JVNDB-2010-002112 Drupal の OpenID モジュールにおける認証を回避される脆弱性 Drupal の OpenID モジュールには、フィールドの署名を確認しない不備があり、OpenID 2.0 プロトコルの仕様違反があるため、OpenID プロバイダから肯定アサーションを取得され、認証を回避される脆弱性が存在します。 CVE-2010-3686 46266 CVE-2010-3686 15043 5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002112.html 2010-08-11 2010-10-07 View