CVE-2019-1010247 — Cross-site Scripting in MOD Auth Openidc

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.4%
top 42.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Openidc MOD Auth OpenidcZmartzone IAM MOD Auth Openidc
Timeline
PublishedJul 19
Latest updateMay 24

Description

ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5zmartzone_iam/mod_auth_openidc2.3.10.1 and earlier [fixed: 2.3.10.2]
▶NVDopenidc/mod_auth_openidc< 2.3.10.2

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-xp9w-hvv3-f7rw: ZmartZone IAM mod_auth_openidc 2↗2022-05-24
▶
OSV
CVE-2019-1010247: ZmartZone IAM mod_auth_openidc 2↗2019-07-19
▶
CVEList
CVE-2019-1010247: ZmartZone IAM mod_auth_openidc 2↗2019-07-19
▶

📋Vendor Advisories

1
Debian
CVE-2019-1010247: libapache2-mod-auth-openidc - ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site S...↗2019
▶
CVE-2019-1010247 — Cross-site Scripting | cvebase