Mod Auth Openidc Zmartzone Mod Auth Openidc

Do you want an email whenever new security vulnerabilities are reported in Zmartzone Mod Auth Openidc?

By the Year

In 2022 there have been 0 vulnerabilities in Zmartzone Mod Auth Openidc . Last year Mod Auth Openidc had 2 security vulnerabilities published. Right now, Mod Auth Openidc is on track to have less security vulnerabilities in 2022 than it did last year.

Year Vulnerabilities Average Score
2022 0 0.00
2021 2 6.80
2020 1 6.10
2019 1 6.10
2018 0 0.00

It may take a day or so for new Mod Auth Openidc vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Zmartzone Mod Auth Openidc Security Vulnerabilities

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server

CVE-2021-39191 6.1 - Medium - September 03, 2021

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.

Open Redirect

mod_auth_openidc 2.4.0 to 2.4.7

CVE-2021-20718 7.5 - High - May 20, 2021

mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.

Resource Exhaustion

A flaw was found in mod_auth_openidc before version 2.4.1

CVE-2019-20479 6.1 - Medium - February 20, 2020

A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning.

Open Redirect

ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS)

CVE-2019-1010247 6.1 - Medium - July 19, 2019

ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.

XSS

Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14

CVE-2017-6059 7.5 - High - April 12, 2017

Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.

Improper Input Validation

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for Zmartzone Mod Auth Openidc or by Zmartzone? Click the Watch button to subscribe.

Zmartzone
Vendor

subscribe