CVE-2012-2760

Published: Jul 25, 2012Modified: Apr 29, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.

Affected (7)

Products: Findingscience: Mod Auth Openid

1 product

Mod Auth Openid

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Findingscience Mod Auth Openid	version ≤ 0.6
Findingscience Mod Auth Openid	Version 0.1
Findingscience Mod Auth Openid	Version 0.2.1
Findingscience Mod Auth Openid	Version 0.2
Findingscience Mod Auth Openid	Version 0.3
Findingscience Mod Auth Openid	Version 0.4
Findingscience Mod Auth Openid	Version 0.5

Related CWEs

References (20)

http://archives.neohapsis.com/archives/fulldisclosure/2012-05/0235.html

Source: cve@mitre.org

http://packetstormsecurity.org/files/112991/Mod_Auth_OpenID-Session-Stealing.html

Source: cve@mitre.org

http://secunia.com/advisories/49247

Source: cve@mitre.org

Vendor Advisory

http://www.exploit-db.com/exploits/18917

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2012:114

Source: cve@mitre.org

http://www.osvdb.org/82139

Source: cve@mitre.org

http://www.securityfocus.com/bid/53661

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/75813

Source: cve@mitre.org

https://github.com/bmuller/mod_auth_openid/blob/master/ChangeLog

Source: cve@mitre.org

https://github.com/bmuller/mod_auth_openid/pull/30

Source: cve@mitre.org

http://archives.neohapsis.com/archives/fulldisclosure/2012-05/0235.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.org/files/112991/Mod_Auth_OpenID-Session-Stealing.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/49247

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.exploit-db.com/exploits/18917

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2012:114

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/82139

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/53661

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/75813

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/bmuller/mod_auth_openid/blob/master/ChangeLog

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/bmuller/mod_auth_openid/pull/30

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.