TI-2017-04558 Aliases CVE-2017-6807 GHSA-25ph-rcq4-c44c

mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack…

LOW 29CWE-79Published 2017-03-13 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.

Why it matters now

EPSS 0.01068 65th percentileScored 2026-11-07

Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:uninett:mod_auth_mellon::::::::	up to 0.13.0	Vulnerable	uninett

cpe:2.3:a:uninett:mod_auth_mellon:*:*:*:*:*:*:*:* Versions up to 0.13.0 Vulnerable ·uninett

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 7	Affected	No fix planned: Will not fix

Timeline

2026-10-02 Threatist record created from CVE-2017-6807
2026-10-03 Alias added: GHSA-25ph-rcq4-c44c

References

Patch 1

https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1

Other 1

https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html

TI-2014-07039 The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of… CVSS 2.0HIGH 9.4
TI-2016-01957 The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount… CVSS 3.0HIGH 7.5
TI-2016-01956 The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the… CVSS 3.0HIGH 7.5
TI-2014-07038 The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive… CVSS 2.0MEDIUM 6.4
TI-2021-02584 Open redirect in mod_auth_mellon CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences