7.5
CVSSv3

CVE-2017-6059

Published: 12/04/2017 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Summary

Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) prior to 2.14 allows remote malicious users to spoof page content via a malicious URL provided to the user, which triggers an invalid request.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openidc mod auth openidc

Vendor Advisories

Synopsis Moderate: mod_auth_openidc security update Type/Severity Security Advisory: Moderate Topic An update for mod_auth_openidc is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CV ...
A text injection flaw was found in how mod_auth_openidc handled error pages An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs(CVE-2017-6059) It was found that mod_auth_openidc did not properly sanitize HTTP headers for certain request paths A remote ...
A text injection flaw was found in how mod_auth_openidc handled error pages An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs (CVE-2017-6059) It was found that mod_auth_openidc did not properly sanitize HTTP headers for certain request paths A remote ...
A text injection flaw was found in how mod_auth_openidc handled error pages An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs ...