CVE-2015-3234
Summary
| CVE | CVE-2015-3234 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2015-06-22 19:59:02 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 7.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Application | Drupal | Drupal | 6.0 | All | All | All |
| Application | Drupal | Drupal | 6.0 | beta1 | All | All |
| Application | Drupal | Drupal | 6.0 | beta2 | All | All |
| Application | Drupal | Drupal | 6.0 | beta3 | All | All |
| Application | Drupal | Drupal | 6.0 | beta4 | All | All |
| Application | Drupal | Drupal | 6.0 | dev | All | All |
| Application | Drupal | Drupal | 6.0 | rc1 | All | All |
| Application | Drupal | Drupal | 6.0 | rc2 | All | All |
| Application | Drupal | Drupal | 6.0 | rc3 | All | All |
| Application | Drupal | Drupal | 6.0 | rc4 | All | All |
| Application | Drupal | Drupal | 6.1 | All | All | All |
| Application | Drupal | Drupal | 6.10 | All | All | All |
| Application | Drupal | Drupal | 6.11 | All | All | All |
| Application | Drupal | Drupal | 6.12 | All | All | All |
| Application | Drupal | Drupal | 6.13 | All | All | All |
| Application | Drupal | Drupal | 6.14 | All | All | All |
| Application | Drupal | Drupal | 6.15 | All | All | All |
| Application | Drupal | Drupal | 6.16 | All | All | All |
| Application | Drupal | Drupal | 6.17 | All | All | All |
| Application | Drupal | Drupal | 6.18 | All | All | All |
| Application | Drupal | Drupal | 6.19 | All | All | All |
| Application | Drupal | Drupal | 6.2 | All | All | All |
| Application | Drupal | Drupal | 6.20 | All | All | All |
| Application | Drupal | Drupal | 6.21 | All | All | All |
| Application | Drupal | Drupal | 6.22 | All | All | All |
| Application | Drupal | Drupal | 6.23 | All | All | All |
| Application | Drupal | Drupal | 6.24 | All | All | All |
| Application | Drupal | Drupal | 6.25 | All | All | All |
| Application | Drupal | Drupal | 6.26 | All | All | All |
| Application | Drupal | Drupal | 6.27 | All | All | All |
| Application | Drupal | Drupal | 6.28 | All | All | All |
| Application | Drupal | Drupal | 6.29 | All | All | All |
| Application | Drupal | Drupal | 6.3 | All | All | All |
| Application | Drupal | Drupal | 6.30 | All | All | All |
| Application | Drupal | Drupal | 6.31 | All | All | All |
| Application | Drupal | Drupal | 6.32 | All | All | All |
| Application | Drupal | Drupal | 6.33 | All | All | All |
| Application | Drupal | Drupal | 6.34 | All | All | All |
| Application | Drupal | Drupal | 6.35 | All | All | All |
| Application | Drupal | Drupal | 6.4 | All | All | All |
| Application | Drupal | Drupal | 6.5 | All | All | All |
| Application | Drupal | Drupal | 6.6 | All | All | All |
| Application | Drupal | Drupal | 6.7 | All | All | All |
| Application | Drupal | Drupal | 6.8 | All | All | All |
| Application | Drupal | Drupal | 6.9 | All | All | All |
| Application | Drupal | Drupal | 7.0 | All | All | All |
| Application | Drupal | Drupal | 7.0 | alpha1 | All | All |
| Application | Drupal | Drupal | 7.0 | alpha2 | All | All |
| Application | Drupal | Drupal | 7.0 | alpha3 | All | All |
| Application | Drupal | Drupal | 7.0 | alpha4 | All | All |
| Application | Drupal | Drupal | 7.0 | alpha5 | All | All |
| Application | Drupal | Drupal | 7.0 | alpha6 | All | All |
| Application | Drupal | Drupal | 7.0 | alpha7 | All | All |
| Application | Drupal | Drupal | 7.0 | beta1 | All | All |
| Application | Drupal | Drupal | 7.0 | beta2 | All | All |
| Application | Drupal | Drupal | 7.0 | beta3 | All | All |
| Application | Drupal | Drupal | 7.0 | dev | All | All |
| Application | Drupal | Drupal | 7.0 | rc1 | All | All |
| Application | Drupal | Drupal | 7.0 | rc2 | All | All |
| Application | Drupal | Drupal | 7.0 | rc3 | All | All |
| Application | Drupal | Drupal | 7.0 | rc4 | All | All |
| Application | Drupal | Drupal | 7.1 | All | All | All |
| Application | Drupal | Drupal | 7.10 | All | All | All |
| Application | Drupal | Drupal | 7.11 | All | All | All |
| Application | Drupal | Drupal | 7.12 | All | All | All |
| Application | Drupal | Drupal | 7.13 | All | All | All |
| Application | Drupal | Drupal | 7.14 | All | All | All |
| Application | Drupal | Drupal | 7.15 | All | All | All |
| Application | Drupal | Drupal | 7.16 | All | All | All |
| Application | Drupal | Drupal | 7.17 | All | All | All |
| Application | Drupal | Drupal | 7.18 | All | All | All |
| Application | Drupal | Drupal | 7.19 | All | All | All |
| Application | Drupal | Drupal | 7.2 | All | All | All |
| Application | Drupal | Drupal | 7.20 | All | All | All |
| Application | Drupal | Drupal | 7.21 | All | All | All |
| Application | Drupal | Drupal | 7.22 | All | All | All |
| Application | Drupal | Drupal | 7.23 | All | All | All |
| Application | Drupal | Drupal | 7.24 | All | All | All |
| Application | Drupal | Drupal | 7.25 | All | All | All |
| Application | Drupal | Drupal | 7.26 | All | All | All |
| Application | Drupal | Drupal | 7.27 | All | All | All |
| Application | Drupal | Drupal | 7.28 | All | All | All |
| Application | Drupal | Drupal | 7.29 | All | All | All |
| Application | Drupal | Drupal | 7.3 | All | All | All |
| Application | Drupal | Drupal | 7.30 | All | All | All |
| Application | Drupal | Drupal | 7.33 | All | All | All |
| Application | Drupal | Drupal | 7.34 | All | All | All |
| Application | Drupal | Drupal | 7.35 | All | All | All |
| Application | Drupal | Drupal | 7.36 | All | All | All |
| Application | Drupal | Drupal | 7.37 | All | All | All |
| Application | Drupal | Drupal | 7.4 | All | All | All |
| Application | Drupal | Drupal | 7.5 | All | All | All |
| Application | Drupal | Drupal | 7.6 | All | All | All |
| Application | Drupal | Drupal | 7.7 | All | All | All |
| Application | Drupal | Drupal | 7.8 | All | All | All |
| Application | Drupal | Drupal | 7.9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-002 | Drupal.org | af854a3a-2127-422b-91ae-364da2661108 | www.drupal.org | Patch, Vendor Advisory |
| Drupal OpenID module CVE-2015-3234 Session Hijacking Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Debian -- Security Information -- DSA-3291-1 drupal7 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| [SECURITY] Fedora 21 Update: drupal7-7.38-1.fc21 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 22 Update: drupal7-7.38-1.fc22 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.