PT-2019-7246 · Apache · Mod Ucam Webauth

Published 2019-05-13 · Updated 2019-05-20 · CVE-2015-9287

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions mod ucam webauth versions prior to 2.0.2

Description A Directory Traversal issue was discovered, allowing an attacker to manipulate the kid field in the IdP's HTTP response message, specifically the "WLS-Response". The kid field, which should only represent an integer, can be set to any string value as it is not signed. This could be exploited to force the application agent to load the RSA public key from an unintended location, potentially compromising message integrity checking.

Recommendations For mod ucam webauth versions prior to 2.0.2, update to version 2.0.2 or later to resolve the issue. As a temporary workaround, consider validating and restricting the kid field to ensure it only accepts integer values to prevent manipulation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2015-9287

Affected Products

Mod Ucam Webauth

References · 3

• 🔥 https://github.com/grymer/CVE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9287 · Security Note
• https://doi.org/10.1007/978-3-030-03251-7_1 · Note