vulnwire
8.6high

CVE-2017-6413

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.6
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.3%
percentile 91%
Public exploits
0
none known

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.

Exploit prediction (EPSS)

4.25% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:P/A:N

Classification

Weakness

References

  • github.com /pingidentity/mod_auth_openidc/blob/master/ChangeLog · x_refsource_CONFIRM, x_transferred
  • github.com /pingidentity/mod_auth_openidc/releases/tag/v2.1.6 · x_refsource_CONFIRM, x_transferred
  • github.com /pingidentity/mod_auth_openidc/commit/21e3728a825c41ab41efa75e664108051bb9665e · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/96549 · vdb-entry, x_refsource_BID, x_transferred
  • access.redhat.com /errata/RHSA-2019:2112 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPII · vendor-advisory, x_refsource_FEDORA, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/2V3HIGXMUKJGOBMAQAQPGC7G · vendor-advisory, x_refsource_FEDORA, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/WTWUMQ46GZY3O4WU4JCF333L · vendor-advisory, x_refsource_FEDORA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.