| Package | Affected versions | Patched versions |
|---|---|---|
| drupal | = 6.0= 6.1= 6.10= 6.11= 6.12= 6.13= 6.14= 6.15= 6.16= 6.17= 6.2= 6.3= 6.4= 6.5= 6.6= 6.7= 6.8= 6.9 | |
| openid | = 5.x-1.0= 5.x-1.1= 5.x-1.2= 5.x-1.3= 5.x-1.x |
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free