Drupal OpenID module CVE-2015-3234 Session Hijacking Vulnerability

Bugtraq ID:	75294
Class:	Unknown
CVE:	CVE-2015-3234
Remote:	Yes
Local:	No
Published:	Jun 18 2015 12:00AM
Updated:	Jul 15 2015 12:38AM
Credit:	Vladislav Mladenov, Christian Mainka, and Christian Koßmann.
Vulnerable:	Drupal Drupal 7.6 Drupal Drupal 7.5 Drupal Drupal 7.4 Drupal Drupal 7.3 Drupal Drupal 7.2 Drupal Drupal 7.14 Drupal Drupal 7.13 Drupal Drupal 7.12 Drupal Drupal 7.11 Drupal Drupal 7.10 Drupal Drupal 7.1 Drupal Drupal 7.0 Drupal Drupal 6.9 Drupal Drupal 6.8 Drupal Drupal 6.7 Drupal Drupal 6.6 Drupal Drupal 6.5 Drupal Drupal 6.4 Drupal Drupal 6.3 Drupal Drupal 6.23 Drupal Drupal 6.22 Drupal Drupal 6.2 Drupal Drupal 6.18 Drupal Drupal 6.17 Drupal Drupal 6.16 Drupal Drupal 6.15 Drupal Drupal 6.14 Drupal Drupal 6.13 Drupal Drupal 6.12 Drupal Drupal 6.11 Drupal Drupal 6.10 Drupal Drupal 6.1 Drupal Drupal 6.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Drupal OpenID module CVE-2015-3234 Session Hijacking Vulnerability

Drupal is prone to a session-hijacking vulnerability.

Successful exploits may allow an attacker to gain unauthorized access to the affected application or impersonate trusted servers, which will aid in further attacks.

Drupal OpenID module CVE-2015-3234 Session Hijacking Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Drupal OpenID module CVE-2015-3234 Session Hijacking Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal OpenID module CVE-2015-3234 Session Hijacking Vulnerability

References:

• Drupal Homepage (Drupal)