CVE-2017-6059
mod_auth_openidc: Shows user-supplied content on error pages
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
Mod_auth_openidc.c en el módulo de autenticación Ping Identity OpenID Connect para Apache (también conocido como mod_auth_openidc) en versiones anteriores a 2.14 permite a los atacantes remotos falsificar el contenido de la página a través de una URL malintencionada proporcionada al usuario, lo que desencadena una solicitud no válida.
A text injection flaw was found in how mod_auth_openidc handled error pages. An attacker could potentially use this flaw to conduct content spoofing and phishing attacks by tricking users into opening specially crafted URLs.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-02-17 CVE Reserved
- 2017-04-12 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2017/02/17/6 | Mailing List |
|
| http://www.securityfocus.com/bid/96299 | Third Party Advisory |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Openidc Search vendor "Openidc" | Mod Auth Openidc Search vendor "Openidc" for product "Mod Auth Openidc" | < 2.1.4 Search vendor "Openidc" for product "Mod Auth Openidc" and version " < 2.1.4" | - |
Affected
| ||||||