UBUNTU-CVE-2016-2049
Dashboard / Vulnerabilities / UBUNTU-CVE-2016-2049
Summary:
Details: examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted HTTP Host header.
References: https://ubuntu.com/security/CVE-2016-2049, http://www.openwall.com/lists/oss-security/2016/01/24/2, https://www.cve.org/CVERecord?id=CVE-2016-2049
Affected packages
Package
Name: php-openid
Purl: pkg:deb/ubuntu/[email protected]?arch=source&distro=xenial
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
2.2.2-1.2
2.2.2-1.2ubuntu1
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
