CVE-2015-3234

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 22, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-32356.0Foreman before 1.9.0 allows remote authenticated users with the edit_users permission to edit administrator users and change their passwordsCVE-2015-32365.0cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_eCVE-2015-32376.4The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memoCVE-2015-32386.5The _unix_run_helper_binary function in the pam_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, aCVE-2015-32393.3Off-by-one error in the dwarf_to_unw_regnum function in include/dwarf_i.h in libunwind 1.1 allows local users to have unspecified impact viaCVE-2015-32404.3The pluto IKE daemon in libreswan before 3.15 and Openswan before 2.6.45, when built with NSS, allows remote attackers to cause a denial of CVE-2015-32416.8OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, whCVE-2015-32435.5rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/loCVE-2015-32444.9The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPoCVE-2015-32452.1Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper prograCVE-2015-32467.4libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, wCVE-2015-32476.9Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of s
CVE-2015-3234: Medium severity, CVSS 4.3 | Vulnix