CVE-2010-3685

2010-09-2900:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.005 Low

EPSS

Percentile

75.9%

JSON

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x
before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking
for reuse of openid.response_nonce values, which allows remote attackers to
bypass authentication by leveraging an assertion from an OpenID provider.

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchdrupal5< 5.7-1ubuntu1.3UNKNOWN
ubuntu9.10noarchdrupal5< 5.18-1.1ubuntu2.2UNKNOWN
ubuntu10.04noarchdrupal6< 6.16-1ubuntu0.1UNKNOWN