CVE-2014-2684 The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value id...
MediumCVSS 6.4
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 does not verify that the openid_op_endpoint value identifies the same Identity Provider as the provider used in the association handle, which allows remote attackers to bypass authentication and spoof arbitrary OpenID identities by using a malicious OpenID Provider that generates OpenID tokens with arbitrary identifier and claimed_id values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zendopenid | <= 2.0.1 | No fix listed |
| zend framework | <= 1.12.4 | No fix listed |
References
- advisories.mageia.org
- framework.zend.com vendor-advisory
- [oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02 mailing-list
- DSA-3265 vendor-advisory
- MDVSA-2014:072 vendor-advisory
- 66358 vdb-entry