PT-2007-3033 · Openid · Openid

Published 2007-03-24 · Updated 2008-11-13 · CVE-2007-1652

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: OpenID (affected versions not specified)

Description: The issue allows remote attackers to forcibly log a user into an OpenID enabled site via a crafted web page. This can lead to the divulgence of the user's personal information to the site and the addition of the site to the trusted sites list. The problem is related to cached tokens.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1652

Affected Products

Openid

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-1652 · Security Note
• http://openid.net/pipermail/security/2007-March/000306.html · Note
• http://openid.net/pipermail/security/2007-March/000291.html · Note
• http://openid.net/pipermail/security/2007-March/000286.html · Note
• http://openid.net/pipermail/security/2007-March/000288.html · Note
• http://osvdb.org/43601 · Note
• http://openid.net/pipermail/security/2007-March/000311.html · Note
• http://janrain.com/blog/2007/03/22/myopenid-security-fix · Note