A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-mod_auth_mellonalma-upgrade-mod_auth_mellon-diagnostics | May 13, 2022 | May 10, 2022 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-mod_auth_mellonamazon-linux-ami-2-upgrade-mod_auth_mellon-debuginfoamazon-linux-ami-2-upgrade-mod_auth_mellon-diagnostics | Jun 8, 2023 | Aug 22, 2022 | |
| Amazon_linux | — | amazon-linux-upgrade-mod24_auth_mellon | Jun 9, 2023 | Sep 2, 2021 |
| Centos_linux | — | centos-upgrade-mod_auth_melloncentos-upgrade-mod_auth_mellon-debuginfocentos-upgrade-mod_auth_mellon-debugsourcecentos-upgrade-mod_auth_mellon-diagnosticscentos-upgrade-mod_auth_mellon-diagnostics-debuginfo | May 13, 2022 | May 10, 2022 |
| Debian | debian-upgrade-libapache2-mod-auth-mellon | Mar 14, 2023 | Aug 22, 2022 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-mod_auth_mellon | Oct 26, 2021 | Sep 26, 2021 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-mod_auth_mellon | Sep 29, 2021 | Sep 26, 2021 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-mod_auth_mellon | Mar 29, 2022 | Sep 26, 2021 | |
| Oracle_linux | — | oracle-linux-upgrade-mod-auth-mellonoracle-linux-upgrade-mod-auth-mellon-diagnostics | May 18, 2022 | Jul 29, 2021 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-mod_auth_mellonredhat-upgrade-mod_auth_mellon-debuginforedhat-upgrade-mod_auth_mellon-debugsourceredhat-upgrade-mod_auth_mellon-diagnosticsredhat-upgrade-mod_auth_mellon-diagnostics-debuginfo | May 13, 2022 | May 10, 2022 | |
| Rocky_linux | rocky-upgrade-mod_auth_mellonrocky-upgrade-mod_auth_mellon-debuginforocky-upgrade-mod_auth_mellon-debugsourcerocky-upgrade-mod_auth_mellon-diagnosticsrocky-upgrade-mod_auth_mellon-diagnostics-debuginfo | Mar 5, 2024 | Aug 22, 2022 | |
| Suse | — | suse-upgrade-apache2-mod_auth_mellonsuse-upgrade-apache2-mod_auth_mellon-diagnosticssuse-upgrade-apache2-mod_auth_mellon-doc | Sep 3, 2021 | Sep 2, 2021 |
| Ubuntu | ubuntu-upgrade-libapache2-mod-auth-mellon | Sep 9, 2021 | Sep 2, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub