CVE-2010-3091

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the…

published September 29, 2010

CVSS
—
EPSS
2%
Percentile
83.6
In the wild
Unconfirmed
What it is

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02372 · 83.6th percentile
Published
2010-09-29T16:00Z
EPSS history
Timeline
  • 29 SEP 16:00Z
    The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the…
    cvelistv5