CVE-2016-2049

Summary

examples/consumer/common.php in JanRain PHP OpenID library (aka php-openid) improperly checks the openid.realm parameter against the SERVER_NAME element in the SERVER superglobal array, which might allow remote attackers to hijack the authentication of arbitrary users via vectors involving a crafted HTTP Host header.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://www.openwall.com/lists/oss-security/2016/01/24/5
• http://www.openwall.com/lists/oss-security/2016/01/24/2

References

• http://www.openwall.com/lists/oss-security/2016/01/24/5
• http://www.openwall.com/lists/oss-security/2016/01/24/2

• ←Previous
• Next→