OpenID Authentication Bypass in Zend Framework by Zend Technologies
CVE-2014-2685

Currently unrated

Key Information:

Vendor

Zend

Status
Zend Framework
Vendor
CVE Published:
4 September 2014
đź”” Create Zend Vulnerability Alert

What is CVE-2014-2685?

The GenericConsumer class in the Consumer component of ZendOpenId prior to version 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 prior to version 1.12.4 is susceptible to an authentication bypass. This vulnerability arises from a violation of the OpenID 2.0 protocol, wherein merely affirming that at least one field is signed permits remote attackers to bypass user authentication through manipulation of an assertion provided by an OpenID provider.

References

http://seclists.org/oss-sec/2014/q2/0
mailing-listx_refsource_MLIST
http://www.mandriva.com/security/advisories?name=MDVSA-20...
vendor-advisoryx_refsource_MANDRIVA
http://advisories.mageia.org/MGASA-2014-0151.html
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.