CVE-2010-3685

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of…

published September 29, 2010

CVSS
—
EPSS
2%
Percentile
83.7
In the wild
Unconfirmed
What it is

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02372 · 83.7th percentile
Published
2010-09-29T16:00Z
EPSS history
Timeline
  • 29 SEP 16:00Z
    The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of…
    cvelistv5