PT-2007-3032 · Openid · Openid

Publicado 2007-03-24 · Atualizado 2008-11-13 · CVE-2007-1651

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: OpenID (affected versions not specified)

Description: A cross-site request forgery (CSRF) issue in OpenID enables remote attackers to restore a user's login session on an OpenID-enabled site. This occurs after the user has signed into an OpenID server, logged into the OpenID-enabled site, and then logged out of the OpenID-enabled site. The attack is related to an arbitrary remote web site and cached tokens.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-1651

Produtos afetados

Openid

Referências · 8

• http://openid.net/pipermail/security/2007-March/000306.html · Nota
• http://openid.net/pipermail/security/2007-March/000291.html · Nota
• http://openid.net/pipermail/security/2007-March/000286.html · Nota
• http://openid.net/pipermail/security/2007-March/000288.html · Nota
• http://osvdb.org/43600 · Nota
• http://openid.net/pipermail/security/2007-March/000311.html · Nota
• http://janrain.com/blog/2007/03/22/myopenid-security-fix · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1651 · Nota de Segurança