A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mod_auth_mellonUpgrade mod_auth_mellon-diagnostics | May 13, 2022 | May 10, 2022 |
| Amazon Linux Ami 2 | — | Upgrade mod_auth_mellon-debuginfoUpgrade mod_auth_mellonUpgrade mod_auth_mellon-diagnostics | Jun 8, 2023 | Aug 22, 2022 |
| Amazon_linux | — | Upgrade mod24_auth_mellon | Jun 9, 2023 | Sep 2, 2021 |
| Centos_linux | — | Upgrade mod_auth_mellon-diagnosticsUpgrade mod_auth_mellon-diagnostics-debuginfoUpgrade mod_auth_mellon-debugsourceUpgrade mod_auth_mellon-debuginfoUpgrade mod_auth_mellon | May 13, 2022 | May 10, 2022 |
| Debian | — | Upgrade libapache2-mod-auth-mellon | Mar 14, 2023 | Aug 22, 2022 |
| Huawei Euleros 2_0_sp3 | — | Upgrade mod_auth_mellon | Oct 26, 2021 | Sep 26, 2021 |
| Huawei Euleros 2_0_sp5 | — | Upgrade mod_auth_mellon | Sep 29, 2021 | Sep 26, 2021 |
| Huawei Euleros 2_0_sp8 | — | Upgrade mod_auth_mellon | Mar 29, 2022 | Sep 26, 2021 |
| Oracle_linux | — | Upgrade mod_auth_mellon-diagnosticsUpgrade mod_auth_mellon | May 18, 2022 | Jul 29, 2021 |
| Redhat_linux | — | Upgrade mod_auth_mellonUpgrade mod_auth_mellon-debugsourceUpgrade mod_auth_mellon-debuginfoUpgrade mod_auth_mellon-diagnostics-debuginfoUpgrade mod_auth_mellon-diagnosticsNo solution exists | May 13, 2022 | May 10, 2022 |
| Rocky_linux | — | Upgrade mod_auth_mellon-debugsourceUpgrade mod_auth_mellon-diagnostics-debuginfoUpgrade mod_auth_mellon-debuginfoUpgrade mod_auth_mellonUpgrade mod_auth_mellon-diagnostics | Mar 5, 2024 | Aug 22, 2022 |
| Suse | — | Upgrade apache2-mod_auth_mellon-diagnosticsUpgrade apache2-mod_auth_mellon-docUpgrade apache2-mod_auth_mellon | Sep 3, 2021 | Sep 2, 2021 |
| Ubuntu | — | Upgrade libapache2-mod-auth-mellon | Sep 9, 2021 | Sep 2, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub