FKIE_CVE-2010-3686

Vulnerability from fkie_nvd - Published: 2010-09-29 17:00 - Updated: 2025-04-11 00:51
Severity ?
Summary
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
References
cve@mitre.orghttp://drupal.org/node/880476Patch, Vendor Advisory
cve@mitre.orghttp://drupal.org/node/880480Patch, Vendor Advisory
cve@mitre.orghttp://marc.info/?l=oss-security&m=128418560705305&w=2
cve@mitre.orghttp://marc.info/?l=oss-security&m=128440896914512&w=2
cve@mitre.orghttp://www.debian.org/security/2010/dsa-2113
cve@mitre.orghttp://www.securityfocus.com/bid/42388
af854a3a-2127-422b-91ae-364da2661108http://drupal.org/node/880476Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://drupal.org/node/880480Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=oss-security&m=128418560705305&w=2
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=oss-security&m=128440896914512&w=2
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2010/dsa-2113
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/42388
Impacted products
Vendor Product Version
drupal drupal 6.0
drupal drupal 6.0
drupal drupal 6.0
drupal drupal 6.0
drupal drupal 6.0
drupal drupal 6.0
drupal drupal 6.0
drupal drupal 6.0
drupal drupal 6.0
drupal drupal 6.0
drupal drupal 6.1
drupal drupal 6.2
drupal drupal 6.3
drupal drupal 6.4
drupal drupal 6.5
drupal drupal 6.6
drupal drupal 6.7
drupal drupal 6.8
drupal drupal 6.9
drupal drupal 6.10
drupal drupal 6.11
drupal drupal 6.12
drupal drupal 6.13
drupal drupal 6.14
drupal drupal 6.15
drupal drupal 6.16
drupal drupal 6.17
peter_wolanin openid 5.x-1.0
peter_wolanin openid 5.x-1.1
peter_wolanin openid 5.x-1.2
peter_wolanin openid 5.x-1.3
peter_wolanin openid 5.x-1.x
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFE07AAD-9207-4C5F-A108-7F7753E4F48C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "D4149703-F7BB-4513-9379-992C089532D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "FCBC7BB8-2B50-476D-BD96-C968F105CE10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "550778E2-BEE5-403D-8744-0B18C5D3AFF3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "31B9F954-3A10-4378-A842-4061E97056DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:dev:*:*:*:*:*:*",
              "matchCriteriaId": "5BD3F6D1-2530-4B4C-86BE-DFDB886BF6E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "FDF535DF-2338-4BF8-A9AC-3B6C60C4D591",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "58876D53-BCE4-459E-AC75-37E4E46621CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "937F4629-2AA1-4954-BF72-8E9CAF1B67FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.0:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "6410BD0A-1B47-4EC2-8D2A-161ADBB09699",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "52D8F291-CBEB-4EAA-9388-F63066A2DFA0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0BD5AEC-F20E-4E53-AF3F-2C60BA2D2171",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5D76BC5-0409-4D78-8064-A78B923E9167",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB73B2E1-2554-4CA2-9C82-B694509CE43A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A7827ED-D8AF-42B3-B514-39A04EB0879A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "F491DE31-8DBB-4F4E-8798-F82DC855D08F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "1ADEA9E5-10EB-4AB4-BD90-1F64A15708AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "64D0A167-BE47-4E4E-8467-0AD2F38A3431",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7CBB558-D5A3-4D68-9C62-D1D521BCFEF1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8D25FA1-2F31-40DB-AD54-DB233E060B0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F91E944-26C4-4886-B9B9-F32BD15569BB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7DF00E9-3952-4D1C-8ED5-3270BD9697F6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "0B779FA7-E371-4111-95B7-301C804DC0CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "B89B2E01-DFC7-4672-85E7-3930EE653806",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "39169C30-5F4D-4333-B0B9-0881811F1E01",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9703D3D-C2D3-4EA0-A67E-CC17B0146B10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:6.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "2EEDA1EF-D7DB-47B5-BF6C-A9ED84427030",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:peter_wolanin:openid:5.x-1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "421290CB-E860-4F32-AE8A-644DC73A423A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peter_wolanin:openid:5.x-1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "659265E0-9FB3-4899-B9CE-54C57F65A30F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peter_wolanin:openid:5.x-1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A7E89F5-8445-4A86-9689-D21201DE8481",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peter_wolanin:openid:5.x-1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AAE6553-046E-4A06-B513-120194C29DCC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:peter_wolanin:openid:5.x-1.x:dev:*:*:*:*:*:*",
              "matchCriteriaId": "0E179022-F11E-4928-BA30-635732BE62E7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider."
    },
    {
      "lang": "es",
      "value": "El m\u00f3dulo de OpenID en Drupal v6.x antes de v6.18, y el m\u00f3dulo de OpenID v5.x antes de v5.x-1.4 para Drupal, viola el protocolo OpenID v2.0, al no garantizar que los campos est\u00e1n firmados, lo cual permite a atacantes remotos evitar la autenticaci\u00f3n mediante el aprovechamiento de una afirmaci\u00f3n de un proveedor de OpenID."
    }
  ],
  "id": "CVE-2010-3686",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-09-29T17:00:05.837",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/880476"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/880480"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=oss-security\u0026m=128418560705305\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=oss-security\u0026m=128440896914512\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2010/dsa-2113"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/42388"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/880476"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://drupal.org/node/880480"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=oss-security\u0026m=128418560705305\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=oss-security\u0026m=128440896914512\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2010/dsa-2113"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/42388"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.