Description
The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically granted privileges after a logout or other session change, which allows physically proximate attackers to gain privileges by using an unattended web browser.
References
- 36684 vdb-entry
- 37057 third-party-advisory
- shibboleth-saml2-priv-escalation(53779) vdb-entry
- http://drupal.org/node/604488
- ADV-2009-2919 vdb-entry