CVE-2010-10006 – org.expressme:jopenid

Package

Manager: maven
Name: org.expressme:jopenid
Vulnerable Version: >=0 <1.08

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00117 pctl0.31171

Details

Observable timing discrepancy in JOpenId A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the file JOpenId/src/org/expressme/openid/OpenIdManager.java. The manipulation leads to observable timing discrepancy. Upgrading to version 1.08 is able to address this issue. The name of the patch is c9baaa976b684637f0d5a50268e91846a7a719ab. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218460.

Metadata

Created: 2023-01-18T00:30:18Z
Modified: 2023-01-25T02:56:52Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-m4f8-p58g-j8mj/GHSA-m4f8-p58g-j8mj.json
CWE IDs: ["CWE-203", "CWE-208"]
Alternative ID: GHSA-m4f8-p58g-j8mj
Finding: F026
Auto approve: 1