PT-2007-3033 · Openid · Openid

Publicado 2007-03-24 · Atualizado 2008-11-13 · CVE-2007-1652

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: OpenID (affected versions not specified)

Description: The issue allows remote attackers to forcibly log a user into an OpenID enabled site via a crafted web page. This can lead to the divulgence of the user's personal information to the site and the addition of the site to the trusted sites list. The problem is related to cached tokens.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-1652

Produtos afetados

Openid

Referências · 8

• http://openid.net/pipermail/security/2007-March/000306.html · Nota
• http://openid.net/pipermail/security/2007-March/000291.html · Nota
• http://openid.net/pipermail/security/2007-March/000286.html · Nota
• http://openid.net/pipermail/security/2007-March/000288.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1652 · Nota de Segurança
• http://osvdb.org/43601 · Nota
• http://openid.net/pipermail/security/2007-March/000311.html · Nota
• http://janrain.com/blog/2007/03/22/myopenid-security-fix · Nota