PT-2017-4171 · Apache+5 · Mod Auth Openidc+5
Publicado
2017-01-30
·
Atualizado
2025-12-29
·
CVE-2021-32786
CVSS v3.1
6.1
Média
| Vetor | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
mod auth openidc versions prior to 2.4.9
Description
The issue is related to the
oidc validate redirect url() function in mod auth openidc, which does not parse URLs the same way as most browsers do. This leads to an Open Redirect vulnerability in the logout functionality, allowing a remote attacker to access and compromise confidential data. The vulnerability can be mitigated by configuring mod auth openidc to only allow redirection whose destination matches a given regular expression.Recommendations
For versions prior to 2.4.9, update to version 2.4.9 or later, where the bug has been fixed by replacing any backslash of the URL to redirect with slashes.
As a temporary workaround, consider configuring
mod auth openidc to only allow redirection whose destination matches a given regular expression.Exploit
Correção
Open Redirect
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Mod Auth Openidc