Uninett mod_auth_mellon 0.7.0

CPE Details

Uninett mod_auth_mellon 0.7.0
uninett
mod_auth_mellon
0.7.0
2019-07-02
14h45 +00:00
2019-07-02
14h45 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:uninett:mod_auth_mellon:0.7.0:*:*:*:*:*:*:*

Informations

Vendor

uninett

Product

mod_auth_mellon

Version

0.7.0

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-3639 2022-08-22 12h49 +00:00 A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
6.1
Medium
CVE-2017-6807 2017-03-13 13h00 +00:00 mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.
6.1
Medium
CVE-2016-2145 2016-04-15 12h00 +00:00 The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.
7.5
High
CVE-2016-2146 2016-04-15 12h00 +00:00 The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.
7.5
High
CVE-2014-8566 2014-11-15 20h00 +00:00 The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."
6.4
CVE-2014-8567 2014-11-14 14h00 +00:00 The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
9.4