CVE-2013-4552 lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name (uid) in a cookie.
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lib/Auth/Source/External.php in the drupalauth module before 1.2.2 for simpleSAMLphp allows remote attackers to authenticate as an arbitrary user via the user name (uid) in a cookie.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupalauth project drupalauth | <= 1.2.1 | No fix listed |
References
- [oss-security] 20131105 CVE request: drupalauth module for simpleSAMLphp trivial impersonation mailing-list patch
- [oss-security] 20131108 Re: CVE request: drupalauth module for simpleSAMLphp trivial impersonation mailing-list patch
- code.google.com patch vendor-advisory