CVE Vulnerability

CVE-2007-1652

OpenID allows remote attackers to forcibly log a user into an OpenID enabled site, divulge the user's personal information to this site, and add it site to the trusted sites list via a crafted web page, related to cached tokens.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

References
Link Resource
http://openid.net/pipermail/security/2007-March/000286.html
http://openid.net/pipermail/security/2007-March/000288.html
http://openid.net/pipermail/security/2007-March/000291.html
http://openid.net/pipermail/security/2007-March/000306.html
http://openid.net/pipermail/security/2007-March/000311.html
http://janrain.com/blog/2007/03/22/myopenid-security-fix/
http://osvdb.org/43601
Configurations

Configuration 1

cpe:2.3:a:openid:openid:*:*:*:*:*:*:*:*
Information

Published : 2007-03-24 12:19

Updated : 2008-11-13 06:35

NVD link : CVE-2007-1652

Mitre link : CVE-2007-1652

Products Affected
No products.
CWE
NVD-CWE-Other