Vulnerabilities > CVE-2021-3639 - Unspecified vulnerability in Uninett MOD Auth Mellon

CVSS 6.1 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

LOW

Availability impact

NONE

network

low complexity

uninett

NVD

Published: 2022-08-22

Updated: 2024-11-21

Summary

A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.

Vulnerable Configurations

Part	Description	Count
Application	Uninett Uninett MOD Auth Mellon - Uninett MOD Auth Mellon 0.4.0 Uninett MOD Auth Mellon 0.5.0 Uninett MOD Auth Mellon 0.6.0 Uninett MOD Auth Mellon 0.6.1 Uninett MOD Auth Mellon 0.7.0 Uninett MOD Auth Mellon 0.8.0 Uninett MOD Auth Mellon 0.8.1 Uninett MOD Auth Mellon 0.9.0 Uninett MOD Auth Mellon 0.9.1 Uninett MOD Auth Mellon 0.10.0 Uninett MOD Auth Mellon 0.11.0 Uninett MOD Auth Mellon 0.11.1 Uninett MOD Auth Mellon 0.12.0 Uninett MOD Auth Mellon 0.13.0 Uninett MOD Auth Mellon 0.13.1 Uninett MOD Auth Mellon 0.14.0 Uninett MOD Auth Mellon 0.14.1 Uninett MOD Auth Mellon 0.14.2 Uninett MOD Auth Mellon 0.15.0 Uninett MOD Auth Mellon 0.16.0 Uninett MOD Auth Mellon 0.17.0	23

Summary

Vulnerable Configurations

References