Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Mod_auth_openidc
(Openidc)| Repositories | https://github.com/pingidentity/mod_auth_openidc |
| #Vulnerabilities | 15 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2017-03-02 | CVE-2017-6413 | The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic. | Mod_auth_openidc | 8.6 | ||
| 2017-04-12 | CVE-2017-6059 | Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request. | Mod_auth_openidc | 7.5 | ||
| 2019-11-26 | CVE-2019-14857 | A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon. | Mod_auth_openidc | 6.1 | ||
| 2020-02-20 | CVE-2019-20479 | A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning. | Debian_linux, Fedora, Mod_auth_openidc, Leap | 6.1 | ||
| 2019-07-19 | CVE-2019-1010247 | ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2. | Mod_auth_openidc | 6.1 |