Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2010-3686

Date: October 3, 2022

The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.

Severity Score

Related Resources (9)

http://drupal.org/node/880476
https://nvd.nist.gov/vuln/detail/CVE-2010-3686
https://people.canonical.com/~ubuntu-security/cve/CVE-2010-3686
http://marc.info/?l=oss-security&m=128440896914512&w=2
http://www.securityfocus.com/bid/42388
http://drupal.org/node/880480
http://marc.info/?l=oss-security&m=128418560705305&w=2
http://www.debian.org/security/2010/dsa-2113
https://www.mend.io/vulnerability-database/CVE-2010-3686

Severity Score

Weakness Type (CWE)

Authentication Issues

CWE-287

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): LOW
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us