2 lines
3.0 KiB
JSON
2 lines
3.0 KiB
JSON
{"affected":[{"affectedData":[{"product":"mod_auth_mellon","vendor":"n/a","versions":[{"status":"affected","version":"Fixed in v0.18.0"}]}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:uninett:mod_auth_mellon:*:*:*:*:*:*:*:*","matchCriteriaId":"BCD3E2E3-47B7-4C46-8DD0-85000CA4D5D7","versionEndExcluding":"0.18.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity."},{"lang":"es","value":"Se ha encontrado un fallo en mod_auth_mellon que no sanea correctamente las URL de cierre de sesión. Este problema podría ser usado por un atacante para facilitar los ataques de phishing engañando a usuarios para que visiten la URL de una aplicación web confiable que redirige a un servidor externo y potencialmente malicioso. La mayor amenaza de esta responsabilidad es para la confidencialidad y la integridad."}],"id":"CVE-2021-3639","lastModified":"2026-06-17T04:05:29.293","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2022-08-22T15:15:13.633","references":[{"source":"secalert@redhat.com","tags":["Patch","Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2021-3639"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980648"},{"source":"secalert@redhat.com","tags":["Patch","Third Party Advisory"],"url":"https://github.com/latchset/mod_auth_mellon/commit/42a11261b9dad2e48d70bdff7c53dd57a12db6f5"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2021-3639"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980648"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/latchset/mod_auth_mellon/commit/42a11261b9dad2e48d70bdff7c53dd57a12db6f5"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"secalert@redhat.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-601"}],"source":"nvd@nist.gov","type":"Secondary"}]}
|