TI-2019-09768 Aliases CVE-2019-13038 GHSA-67h8-fxm4-vr72

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as…

LOW 30CWE-601Published 2019-06-29 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-601.

Summary

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.

Why it matters now

EPSS 0.01423 73rd percentileScored 2026-11-07

Fix Partial Red Hat: 2 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:mod_auth_mellon_project:mod_auth_mellon::::::apache::*	up to 0.14.2	Vulnerable	Mod Auth Mellon Project
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:::::::*	8.8	Vulnerable	Oracle
cpe:2.3:o:fedoraproject:fedora:30:::::::*	30	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:::::::*	31	Vulnerable	Fedoraproject
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::	18.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*	18.10	Vulnerable	Canonical

cpe:2.3:a:mod_auth_mellon_project:mod_auth_mellon:*:*:*:*:*:apache:*:* Versions up to 0.14.2 Vulnerable ·Mod Auth Mellon Project
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical

Remediation

Red Hat 2 advisories

RHSA-2020:1660 Released 2020-04-28 · Red Hat rating Moderate
mod_auth_mellon security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 8) mod_auth_mellon-0.14.0-11.el8, mod_auth_mellon-diagnostics-0.14.0-11.el8
RHSA-2020:1003 Released 2020-03-31 · Red Hat rating Moderate
mod_auth_mellon security and bug fix update
- Red Hat Enterprise Linux Server (v. 7) mod_auth_mellon-0.14.0-8.el7, mod_auth_mellon-diagnostics-0.14.0-8.el7
- Red Hat Enterprise Linux Workstation (v. 7) mod_auth_mellon-0.14.0-8.el7, mod_auth_mellon-diagnostics-0.14.0-8.el7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Software Collections	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2020:1660
Red Hat Enterprise Linux Server (v. 7)	Fixed	RHSA-2020:1003
Red Hat Enterprise Linux Workstation (v. 7)	Fixed	RHSA-2020:1003

Timeline

2026-10-02 Threatist record created from CVE-2019-13038
2026-10-03 Alias added: GHSA-67h8-fxm4-vr72

References

Patch 1

https://www.oracle.com/security-alerts/cpuapr2022.html

Advisory 4

Other 1

[debian-lts-announce] 20230312 [SECURITY] [DLA 3359-1] libapache2-mod-auth-mellon security update

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences