CVE-2009-4527

Published: Dec 31, 2009Modified: Apr 23, 2026

4.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 3.9 / Impact: 6.4

Source: NVD

Description

The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically granted privileges after a logout or other session change, which allows physically proximate attackers to gain privileges by using an unattended web browser.

Affected (17)

Products: Niif: Shib Auth

Niif

1 product

Shib Auth

Configuration A

17 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Niif Shib Auth	Version 5.x-1.x dev
Niif Shib Auth	Version 5.x-2.1
Niif Shib Auth	Version 5.x-2.2
Niif Shib Auth	Version 5.x-2.4
Niif Shib Auth	Version 5.x-2.5
Niif Shib Auth	Version 5.x-2.x dev
Niif Shib Auth	Version 5.x-3.3
Niif Shib Auth	Version 5.x-3.x dev
Niif Shib Auth	Version 6.x-1.x dev
Niif Shib Auth	Version 6.x-2.0
Niif Shib Auth	Version 6.x-2.1
Niif Shib Auth	Version 6.x-2.2
Niif Shib Auth	Version 6.x-2.x dev
Niif Shib Auth	Version 6.x-3.0
Niif Shib Auth	Version 6.x-3.0 1
Niif Shib Auth	Version 6.x-3.1
Niif Shib Auth	Version 6.x-3.x dev