Read the docs
TI-2019-02887 Aliases CVE-2019-3877GHSA-qr9h-f4fq-2h85

Open redirect in uninett mod_auth_mellon

Priority LOW 31CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 7 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-601.

Summary

A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.

Why it matters now

EPSS 0.02121 81st percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 7 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
uninettmod_auth_mellonv0.14.2—No fix listedCNA
  • mod_auth_mellon Vendoruninett Affected v0.14.2 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:mod_auth_mellon_project:mod_auth_mellon:*:*:*:*:*:apache:*:*before 0.14.2VulnerableMod Auth Mellon Project
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*18.10VulnerableCanonical
  • cpe:2.3:a:mod_auth_mellon_project:mod_auth_mellon:*:*:*:*:*:apache:*:* Versions before 0.14.2 Vulnerable ·Mod Auth Mellon Project
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical

Remediation

Red Hat 2 advisories

  • RHSA-2019:3421 Released 2019-11-05 · Red Hat rating Moderate
    mod_auth_mellon security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) mod_auth_mellon-0.14.0-9.el8, mod_auth_mellon-diagnostics-0.14.0-9.el8
  • RHSA-2019:0766 Released 2019-04-16 · Red Hat rating Important
    mod_auth_mellon security and bug fix update
    • Red Hat Enterprise Linux Server (v. 7) mod_auth_mellon-0.14.0-2.el7_6.4
    • Red Hat Enterprise Linux Server Optional (v. 7) mod_auth_mellon-diagnostics-0.14.0-2.el7_6.4
    • Red Hat Enterprise Linux Workstation (v. 7) mod_auth_mellon-0.14.0-2.el7_6.4
    • Red Hat Enterprise Linux Workstation Optional (v. 7) mod_auth_mellon-diagnostics-0.14.0-2.el7_6.4
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) mod_auth_mellon-0.14.0-2.el7_6.4
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) mod_auth_mellon-diagnostics-0.14.0-2.el7_6.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    uninett mod_auth_mellon — RHSA-2019:0766

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2019-02888 Authentication bypass in uninett mod_auth_mellonPriority MEDIUM 41
    Show all 2 records → Advisory →
  • Advisory ·

    uninett mod_auth_mellon — FEDORA-2019-db1e9b3002

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2019-02888 Authentication bypass in uninett mod_auth_mellonPriority MEDIUM 41
    Show all 2 records → Advisory →
Show 2 more groups
  • Advisory ·

    uninett mod_auth_mellon — FEDORA-2019-2d8ee47f61

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2019-02888 Authentication bypass in uninett mod_auth_mellonPriority MEDIUM 41
    Show all 2 records → Advisory →
  • Advisory ·

    uninett mod_auth_mellon — USN-3924-1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2019-02888 Authentication bypass in uninett mod_auth_mellonPriority MEDIUM 41
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:3421
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:0766
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2019:0766
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:0766
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2019:0766
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2019:0766
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2019:0766

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3877
  2. 2026-10-03 Alias added: GHSA-qr9h-f4fq-2h85

References

Patch 3

Advisory 5

  • TI-2014-07039 The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of… CVSS 2.0HIGH 9.4
  • TI-2021-12310 Missing input validation in dynamic discovery example scripts. CVSS 3.1CRITICAL 9.4
  • TI-2019-02888 Authentication bypass in uninett mod_auth_mellon CVSS 3.0HIGH 8.1
  • TI-2016-01957 The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount… CVSS 3.0HIGH 7.5
  • TI-2016-01956 The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the… CVSS 3.0HIGH 7.5
  • TI-2014-07038 The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive… CVSS 2.0MEDIUM 6.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences