CVE-2019-3877: Medium severity Mod Auth Mellon Project Mod Auth Mellon Apache vulnerability
A vulnerability was found in modauthmellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apruriparse function.
Other sources
A vulnerability was found in modauthmellon. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes using treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apruriparse function.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-3877?
CVE-2019-3877 is a vulnerability found in mod_auth_mellon before v0.14.2.
What is the severity of CVE-2019-3877?
The severity of CVE-2019-3877 is medium with a CVSS score of 6.1.
How does CVE-2019-3877 affect mod_auth_mellon?
CVE-2019-3877 affects mod_auth_mellon before version 0.14.2.
How can I fix CVE-2019-3877?
To fix CVE-2019-3877, update mod_auth_mellon to version 0.14.2 or higher.
Where can I find more information about CVE-2019-3877?
You can find more information about CVE-2019-3877 at the following references: [Link 1], [Link 2], [Link 3].