CVE-2019-13038: Medium severity Mod Auth Mellon Project Mod Auth Mellon Apache vulnerability
Published Jun 29, 2019
·Updated
Last updated 18 August 2025
Other sources
modauthmellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.
— Launchpad
Affected Software
7 affected componentsFixes available
debian/libapache2-mod-auth-mellon
0.17.0-1+deb11u10.18.1-10.19.1-1
Mod Auth Mellon Project Mod Auth Mellon Apache<=0.14.2
Oracle ZFS Storage Appliance Kit=8.8
Fedoraproject Fedora=30
Fedoraproject Fedora=31
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
Remediation
Patch Available
Event History
Jun 29, 2019
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Feb 20, 2026
Data Sourced
via Ubuntu·10:51 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·10:52 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2019-13038.
2
What is the title of the vulnerability?
The title of the vulnerability is 'mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring'.
3
What is the severity of CVE-2019-13038?
The severity of CVE-2019-13038 is medium (6.1).
4
How does CVE-2019-13038 affect the software?
CVE-2019-13038 affects the 'libapache2-mod-auth-mellon' package versions 0.14.2-1+deb10u1, 0.17.0-1+deb11u1, and 0.18.1-1 on Debian, as well as other packages on Ubuntu, Fedora, and Oracle ZFS Storage Appliance Kit.
5
How do I fix CVE-2019-13038?
To fix CVE-2019-13038, update the affected software to versions that include the necessary security patches.