CVE-2021-3639
Medium
Description
A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
SeverityMedium
CVSS6.1
Exploit probability—
ProductUninett Mod Auth Mellon
PublishedAug 22, 2022
First seenAug 22, 2022
Weakness typeCWE-601Open redirect
How to fix
Update
- uninett mod_auth_mellon0.18.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| uninett mod_auth_mellon | v < 0.18.0 | 0.18.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.