CVE-2015-3234

critical

Description

The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.

References

https://www.drupal.org/SA-CORE-2015-002

https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3290

http://www.securityfocus.com/bid/75294

http://www.debian.org/security/2015/dsa-3291

http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161265.html

http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161261.html

Details

Source: Mitre, NVD

Published: 2015-06-22

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.0052