CVE Feed

    Dashboard / CVE / CVE-2019-1010247

    CVE-2019-1010247

    ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.

    Published:Jul 19, 2019
    Last Modified:Nov 21, 2024
    EPS:Jul 19, 2019
    EPSS Score:0.00356
    CVSS Score:6.1

    Affected Products

    Vendor
    Openidc
    Product
    Mod Auth Openidc

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-54789 (CVSS 7.5) — mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server…
    CVE-2024-24814 (CVSS 7.5) — mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP serve…
    CVE-2023-28625 (CVSS 7.5) — mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements …
    CVE-2022-23527 (CVSS 4.7) — mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP serve…
    CVE-2021-39191 (CVSS 4.7) — mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an…
    CVE-2021-32791 (CVSS 5.9) — mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an…
    CVE-2021-32792 (CVSS 3.1) — mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an…
    CVE-2021-32785 (CVSS 5.3) — mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an…
    CVE-2021-32786 (CVSS 4.7) — mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an…
    CVE-2021-20718 (CVSS 7.5) — mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unsp…

    References

    https://github.com/zmartzone/mod_auth_openidc/commit/132a4111bf3791e76437619a66336dce2ce4c79b
    https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.3.10.2
    https://lists.debian.org/debian-lts-announce/2019/08/msg00029.html
    https://lists.debian.org/debian-lts-announce/2020/07/msg00028.html
    https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2019-001_mod_auth_openidc_reflected_xss.txt
    https://github.com/zmartzone/mod_auth_openidc/commit/132a4111bf3791e76437619a66336dce2ce4c79b
    https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.3.10.2
    https://lists.debian.org/debian-lts-announce/2019/08/msg00029.html
    https://lists.debian.org/debian-lts-announce/2020/07/msg00028.html
    https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2019-001_mod_auth_openidc_reflected_xss.txt

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High