CVE-2007-1652 OpenID allows remote attackers to forcibly log a user into an OpenID enabled site, divulge the user's personal information to this site, and add it site to the trusted sites list via a crafted web pag...
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenID allows remote attackers to forcibly log a user into an OpenID enabled site, divulge the user's personal information to this site, and add it site to the trusted sites list via a crafted web page, related to cached tokens.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openid | All versions | No fix listed |
References
- janrain.com
- [security] 20070321 MyOpenID mailing-list
- [security] 20070321 MyOpenID mailing-list
- [security] 20070321 MyOpenID mailing-list
- [security] 20070321 MyOpenID mailing-list
- [security] 20070322 MyOpenID mailing-list
- 43601 vdb-entry