CVE-2021-32792: XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc
modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In modauthopenidc before version 2.4.9, there is an XSS vulnerability in when using OIDCPreservePost On.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mod_auth_openidcto a version that resolves this vulnerability.Fixed in 2.4.9
Event History
Frequently Asked Questions
What is CVE-2021-32792?
CVE-2021-32792 is an XSS vulnerability in mod_auth_openidc before version 2.4.9.
What is mod_auth_openidc?
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party.
How does mod_auth_openidc work?
mod_auth_openidc authenticates users against an OpenID Connect Provider.
What is the severity of CVE-2021-32792?
The severity of CVE-2021-32792 is medium (6.1).
How can I fix CVE-2021-32792?
To fix CVE-2021-32792, you should upgrade to mod_auth_openidc version 2.4.9.