{"id":"CVE-2015-3234","aliases":["DSA-3291-1","EUVD-2015-3290","GHSA-rcwp-vp94-qpq4","MGASA-2015-0253","UBUNTU-CVE-2015-3234"],"status":"published","title":"The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log...","description":"The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01863,"percentile":0.79407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2015-06-18T00:00:00Z","modified":"2026-06-17T00:25:35Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u10"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u10~bpo60+1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1","7.14-2+deb7u5","7.14-2+deb7u6","7.14-2+deb7u6~bpo60+1","7.14-2+deb7u7","7.14-2+deb7u7~bpo60+1","7.14-2+deb7u8","7.14-2+deb7u9","7.14-2+deb7u9~bpo60+1"],"bundled":4},{"source":"osv","ecosystem":"Debian:8","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.32-1+deb8u4"}]}],"versions":["7.32-1+deb8u3","7.32-1+deb8u4~bpo70+1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38-1.mga4"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:5","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161265.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/75294","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.debian.org/security/2015/dsa-3291","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161261.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://www.drupal.org/SA-CORE-2015-002","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3234"},{"url":"https://github.com/advisories/GHSA-rcwp-vp94-qpq4"},{"url":"https://advisories.mageia.org/MGASA-2015-0253.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16147","tags":["report"]},{"url":"https://www.drupal.org/drupal-7.36","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.36-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.37","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.37-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.38","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.38-release-notes","tags":["web"]},{"url":"https://www.debian.org/security/2015/dsa-3291","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3234","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3234","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3234","description":"The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.","status":"published","published":"2015-06-22T19:00:00Z","modified":"2024-08-06T05:39:32.091Z","updated_at":"2026-11-02T14:35:42.680858Z"}],"euvd":[{"id":"EUVD-2015-3290","description":"The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.","status":"published","published":"2015-06-22T19:00:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-rcwp-vp94-qpq4","title":"The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log...","description":"The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.","status":"published","published":"2022-05-17T03:33:11Z","modified":"2023-01-27T05:08:33Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:43:18.939561Z"}],"nvd":[{"id":"CVE-2015-3234","description":"The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.","status":"published","published":"2015-06-22T19:59:02.81Z","modified":"2026-06-17T00:25:35.493Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:05.884985Z"}],"osv":[{"id":"DSA-3291-1","title":"drupal7 - security update","status":"published","published":"2015-06-18T00:00:00Z","modified":"2026-03-09T01:21:12.656744Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0253","title":"Updated drupal package fixes security vulnerability","description":"Incorrect cache handling made private content viewed by \"user 1\" exposed\nto   other, non-privileged users (CVE-2015-3231).\n\nA flaw in the Field UI module made it possible for attackers to redirect\nusers to malicious sites (CVE-2015-3232).\n\nDue to insufficient URL validation, the Overlay module could be used to\nredirect users to malicious sites (CVE-2015-3233).\n\nThe OpenID module allowed an attacker to log in as other users, including\nadministrators (CVE-2015-3234).\n","status":"published","published":"2015-07-01T12:40:22Z","modified":"2026-04-16T06:25:13.384569999Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-3234","description":"The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.","status":"published","published":"2015-06-22T19:59:00Z","modified":"2025-09-08T16:43:22Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}