Vulnerability CVE-2015-3234 - CERT Civis.Net

Vulnerability Name:

CVE-2015-3234 (CCN-104154)

Assigned:

2015-06-17

Published:

2015-06-17

Updated:

2016-12-03

Summary:

The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2015-3234

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-10290

Source: FEDORA
Type: UNKNOWN
FEDORA-2015-10189

Source: DEBIAN
Type: UNKNOWN
DSA-3291

Source: BID
Type: UNKNOWN
75294

Source: XF
Type: UNKNOWN
drupal-cve20153234-sec-bypass(104154)

Source: CCN
Type: DRUPAL-SA-CORE-2015-002
Drupal Core - Critical - Multiple Vulnerabilities

Source: CONFIRM
Type: Patch, Vendor Advisory
https://www.drupal.org/SA-CORE-2015-002

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-3234

Vulnerable Configuration:

Configuration 1:

cpe:/a:drupal:drupal:6.0:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.0:beta1:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.0:beta2:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.0:beta3:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.0:beta4:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.0:dev:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.0:rc1:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.0:rc2:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.0:rc3:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.0:rc4:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.1:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.2:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.3:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.4:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.5:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.6:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.7:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.8:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.9:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.10:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.11:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.12:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.13:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.14:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.15:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.16:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.17:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.18:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.19:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.20:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.21:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.22:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.23:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.24:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.25:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.26:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.27:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.28:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.29:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.30:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.31:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.32:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.33:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.34:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:6.35:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha1:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha2:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha3:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha4:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha5:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha6:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:alpha7:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:beta1:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:beta2:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:beta3:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:dev:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:rc1:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:rc2:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:rc3:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.0:rc4:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.1:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.2:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.3:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.4:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.5:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.6:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.7:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.8:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.9:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.10:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.11:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.12:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.13:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.14:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.15:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.16:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.17:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.18:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.19:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.20:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.21:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.22:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.23:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.24:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.25:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.26:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.27:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.28:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.29:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.30:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.33:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.34:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.35:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.36:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.37:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:debian:debian_linux:7.0:*:*:*:*:*:*:*

OR cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:drupal:drupal:6.35:*:*:*:*:*:*:*

OR cpe:/a:drupal:drupal:7.37:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.cisecurity:def:251	P	DSA-3291-1 -- drupal7 -- security update	2016-02-08
oval:com.ubuntu.artful:def:20153234000	V	CVE-2015-3234 on Ubuntu 17.10 (artful) - medium.	2015-06-22
oval:com.ubuntu.precise:def:20153234000	V	CVE-2015-3234 on Ubuntu 12.04 LTS (precise) - medium.	2015-06-22
oval:com.ubuntu.xenial:def:201532340000000	V	CVE-2015-3234 on Ubuntu 16.04 LTS (xenial) - medium.	2015-06-22
oval:com.ubuntu.trusty:def:20153234000	V	CVE-2015-3234 on Ubuntu 14.04 LTS (trusty) - medium.	2015-06-22
oval:com.ubuntu.xenial:def:20153234000	V	CVE-2015-3234 on Ubuntu 16.04 LTS (xenial) - medium.	2015-06-22