Published: 02/03/2017 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 8.6 | Impact Score: 4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module prior to 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote malicious users to bypass authentication via crafted HTTP traffic.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openidc mod auth openidc

Synopsis Moderate: mod_auth_openidc security update Type/Severity Security Advisory: Moderate Topic An update for mod_auth_openidc is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CV ...

A text injection flaw was found in how mod_auth_openidc handled error pages An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs(CVE-2017-6059) It was found that mod_auth_openidc did not properly sanitize HTTP headers for certain request paths A remote ...

A text injection flaw was found in how mod_auth_openidc handled error pages An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs (CVE-2017-6059) It was found that mod_auth_openidc did not properly sanitize HTTP headers for certain request paths A remote ...

It was found that mod_auth_openidc did not properly sanitize HTTP headers for certain request paths A remote attacker could potentially use this flaw to bypass authentication and access sensitive information by sending crafted HTTP requests ...

CWE-287 https://github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.6 https://github.com/pingidentity/mod_auth_openidc/commit/21e3728a825c41ab41efa75e664108051bb9665e https://github.com/pingidentity/mod_auth_openidc/blob/master/ChangeLog http://www.securityfocus.com/bid/96549 https://access.redhat.com/errata/RHSA-2019:2112 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPIINVFKKB4Z/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V3HIGXMUKJGOBMAQAQPGC7G5YYWSUVA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTWUMQ46GZY3O4WU4JCF333LN53R2XQH/https://access.redhat.com/errata/RHSA-2019:2112 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2019-1329.html

CVE-2017-6413

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect