Vulnerabilities

Filters

2 selected

15 records

Sort

Vendor: OpenIDC Component: Mod Auth Openidc Clear all filters

TI-2024-16331 CVE-2024-24814

Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc

HIGH 72

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0125 Published 2024-02-13 Partial fix · 2.4.15.2 CWE-400

TI-2023-13144 CVE-2023-28625

mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied

MEDIUM 42

mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01316 Published 2023-04-03 Fixed in 2.4.13.2 CWE-476

TI-2022-07586 CVE-2022-23527

Open Redirect in oidc_validate_redirect_url()

LOW 29

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00941 Published 2022-12-14 Partial fix · 2.4.12.2 CWE-601

TI-2021-16576 CVE-2021-39191

URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc

LOW 31

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01735 Published 2021-09-03 Partial fix CWE-601

TI-2021-12458 CVE-2021-32792

XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc

LOW 30

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0151 Published 2021-07-26 Fixed in 2.4.9 CWE-79

TI-2021-12457 CVE-2021-32791

Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc

LOW 29

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01503 Published 2021-07-26 Partial fix · 2.4.9 CWE-323

TI-2021-12452 CVE-2021-32786

Open Redirect in oidc_validate_redirect_url()

LOW 32

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02364 Published 2021-07-22 Partial fix · 2.4.9 CWE-601

TI-2021-12451 CVE-2021-32785

Format string bug in the Redis cache implementation

LOW 38

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02731 Published 2021-07-22 Fixed in 2.4.9 CWE-134

TI-2021-03944 CVE-2021-20718

Uncontrolled resource consumption in OpenIDC mod_auth_openidc

LOW 39

mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03395 Published 2021-05-20 No fix listed CWE-400

TI-2019-14706 CVE-2019-20479 · GHSA-5fmg-x3vm-cm8v

A flaw was found in mod_auth_openidc before version 2.4.1.

LOW 31

A flaw was found in mod_auth_openidc before version 2.4.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01893 Published 2020-02-20 Fixed CWE-601

TI-2019-11061 CVE-2019-14857 · GHSA-797h-qjwj-28jc

Open redirect in [UNKNOWN] mod_auth_openidc

LOW 30

A flaw was found in mod_auth_openidc before version 2.4.0.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01598 Published 2019-11-26 Fixed CWE-601

TI-2019-16038 CVE-2019-1010247 · GHSA-xp9w-hvv3-f7rw

Cross-site scripting in ZmartZone IAM mod_auth_openidc

LOW 30

ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS).

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01268 Published 2019-07-19 No fix listed CWE-79

TI-2017-03968 CVE-2017-6059 · GHSA-rpc9-4cjr-9wxx

Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache…

MEDIUM 41

Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which tri…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05177 Published 2017-04-12 Fixed CWE-20

TI-2017-04220 CVE-2017-6413 · GHSA-9r74-cmm5-qv85

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)…

MEDIUM 44

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" config…

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.04253 Published 2017-03-02 Fixed CWE-287

TI-2017-03971 CVE-2017-6062 · GHSA-5fhw-rc3x-vmxm

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc)…

MEDIUM 44

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" c…

CVSS 3.0HIGH 8.6 Network No auth No interaction EPSS 0.03633 Published 2017-03-02 No fix listed CWE-287