PT-2007-3032 · Openid · Openid

Published 2007-03-24 · Updated 2008-11-13 · CVE-2007-1651

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: OpenID (affected versions not specified)

Description: A cross-site request forgery (CSRF) issue in OpenID enables remote attackers to restore a user's login session on an OpenID-enabled site. This occurs after the user has signed into an OpenID server, logged into the OpenID-enabled site, and then logged out of the OpenID-enabled site. The attack is related to an arbitrary remote web site and cached tokens.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1651

Affected Products

Openid

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-1651 · Security Note
• http://openid.net/pipermail/security/2007-March/000306.html · Note
• http://openid.net/pipermail/security/2007-March/000291.html · Note
• http://openid.net/pipermail/security/2007-March/000286.html · Note
• http://openid.net/pipermail/security/2007-March/000288.html · Note
• http://osvdb.org/43600 · Note
• http://openid.net/pipermail/security/2007-March/000311.html · Note
• http://janrain.com/blog/2007/03/22/myopenid-security-fix · Note