CVE-2019-13038

Опубликовано: 29 июн. 2019

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.

Ссылки

https://github.com/Uninett/mod_auth_mellon/issues/35#issuecomment-503974885
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/03/msg00010.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5E3JVHURJJNDP63CKVX5O5MJAGCQV4K/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU5GVFZW3C2M4ZBL4F7UP7N24FNUCX4E/
https://usn.ubuntu.com/4291-1/
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory
https://github.com/Uninett/mod_auth_mellon/issues/35#issuecomment-503974885
Issue Tracking
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/03/msg00010.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5E3JVHURJJNDP63CKVX5O5MJAGCQV4K/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU5GVFZW3C2M4ZBL4F7UP7N24FNUCX4E/
https://usn.ubuntu.com/4291-1/
Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:mod_auth_mellon_project:mod_auth_mellon:*:*:*:*:*:apache:*:*

Версия до 0.14.2 (включая)

Конфигурация 2

cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

EPSS

Процентиль: 31%

0.00116

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-601

Связанные уязвимости

CVE-2019-13038

CVSS3: 6.1

ubuntu

больше 6 лет назад

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.

CVE-2019-13038

CVSS3: 6.1

redhat

больше 6 лет назад

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.

CVE-2019-13038

CVSS3: 6.1

debian

больше 6 лет назад

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?Retu ...

GHSA-67h8-fxm4-vr72

CVSS3: 6.1

github

больше 3 лет назад

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.

ELSA-2020-1660

oracle-oval

почти 6 лет назад

ELSA-2020-1660: mod_auth_mellon security and bug fix update (MODERATE)

EPSS

Процентиль: 31%

0.00116

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-601