CVE Vulnerabilities

CVE-2010-3685

Improper Authentication

Published: Sep 29, 2010 | Modified: Sep 30, 2010
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Weakness

When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Drupal Drupal 6.0 6.0
Drupal Drupal 6.0 6.0
Drupal Drupal 6.0 6.0
Drupal Drupal 6.0 6.0
Drupal Drupal 6.0 6.0
Drupal Drupal 6.0 6.0
Drupal Drupal 6.0 6.0
Drupal Drupal 6.0 6.0
Drupal Drupal 6.0 6.0
Drupal Drupal 6.0 6.0
Drupal Drupal 6.1 6.1
Drupal Drupal 6.2 6.2
Drupal Drupal 6.3 6.3
Drupal Drupal 6.4 6.4
Drupal Drupal 6.5 6.5
Drupal Drupal 6.6 6.6
Drupal Drupal 6.7 6.7
Drupal Drupal 6.8 6.8
Drupal Drupal 6.9 6.9
Drupal Drupal 6.10 6.10
Drupal Drupal 6.11 6.11
Drupal Drupal 6.12 6.12
Drupal Drupal 6.13 6.13
Drupal Drupal 6.14 6.14
Drupal Drupal 6.15 6.15
Drupal Drupal 6.16 6.16
Drupal Drupal 6.17 6.17
Drupal5 Ubuntu hardy *
Drupal5 Ubuntu jaunty *
Drupal5 Ubuntu karmic *
Drupal5 Ubuntu upstream *
Drupal6 Ubuntu jaunty *
Drupal6 Ubuntu karmic *
Drupal6 Ubuntu lucid *
Drupal6 Ubuntu upstream *

Potential Mitigations

References