MEDIUM
mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft
Published Jun 29, 2019
6.1
MEDIUMCVSS 3.1
EPSS 1.42%
Description
mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.
Affected products
No data.
Configuration 1
- ≤ 0.14.2
Configuration 2
- 8.8
Configuration 3
OR
- 30
- 31
Configuration 4
OR
- 18.04
- 18.10
No data.
Red Hat Enterprise Linux 7
mod_auth_mellon-0:0.14.0-8.el7
Fixed · RHSA-2020:1003
Red Hat Enterprise Linux 8
mod_auth_mellon-0:0.14.0-11.el8
Fixed · RHSA-2020:1660
Red Hat Enterprise Linux 6
mod_auth_mellon
Out of support scope
Red Hat Software Collections
httpd24-mod_auth_mellon
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 7 | mod_auth_mellon-0:0.14.0-8.el7 | Fixed | RHSA-2020:1003 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon-0:0.14.0-11.el8 | Fixed | RHSA-2020:1660 |
| Red Hat Enterprise Linux 6 | mod_auth_mellon | Out of support scope | n/a |
| Red Hat Software Collections | httpd24-mod_auth_mellon | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (10)
- https://access.redhat.com/security/cve/CVE-2019-13038 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1725740 Issue Tracking
- https://github.com/Uninett/mod_auth_mellon/issues/35#issuecomment-503974885 Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/03/msg00010.html mailing-list
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5E3JVHURJJNDP63CKVX5O5MJAGCQV4K/ vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU5GVFZW3C2M4ZBL4F7UP7N24FNUCX4E/ vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-13038
- https://usn.ubuntu.com/4291-1/ vendor-advisoryThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2019-13038
- https://www.oracle.com/security-alerts/cpuapr2022.html PatchThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-13038 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1725740 | Issue Tracking | |
| https://github.com/Uninett/mod_auth_mellon/issues/35#issuecomment-503974885 | Issue TrackingThird Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2023/03/msg00010.html | mailing-list | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5E3JVHURJJNDP63CKVX5O5MJAGCQV4K/ | vendor-advisory | |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XU5GVFZW3C2M4ZBL4F7UP7N24FNUCX4E/ | vendor-advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-13038 | ||
| https://usn.ubuntu.com/4291-1/ | vendor-advisoryThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2019-13038 | ||
| https://www.oracle.com/security-alerts/cpuapr2022.html | PatchThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jun 29, 2019
Updated Aug 4, 2024
Reserved Jun 29, 2019
Link CVE-2019-13038
CISA Vulnrichment
Updated n/a