| Package | Affected versions | Patched versions |
|---|---|---|
| drupal | = 6.0= 6.1= 6.10= 6.11= 6.12= 6.13= 6.14= 6.15= 6.16= 6.17= 6.2= 6.3= 6.4= 6.5= 6.6= 6.7= 6.8= 6.9 | |
| openid | = 5.x-1.0= 5.x-1.1= 5.x-1.2= 5.x-1.3= 5.x-1.x |
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free