ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact     is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The     component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2. (CVE-2019-1010247)

Note that Nessus relies on the presence of the package as reported by the vendor.

Several issues have been found in libapache2-mod-auth-openidc, the OpenID Connect authentication module for the Apache HTTP server.

CVE-2019-14857

Insufficient validation of URLs leads to an Open Redirect vulnerability. An attacker may trick a victim into providing credentials for an OpenID provider by forwarding the request to an illegitimate website.

CVE-2019-20479

Due to insufficient validatation of URLs an Open Redirect vulnerability for URLs beginning with a slash and backslash could be abused.

CVE-2019-1010247

The OIDCRedirectURI page contains generated JavaScript code that uses a poll parameter as a string variable, thus might contain additional JavaScript code. This might result in Criss-Site Scripting (XSS).

For Debian 9 stretch, these problems have been fixed in version 2.1.6-1+deb9u1.

We recommend that you upgrade your libapache2-mod-auth-openidc packages.

For the detailed security status of libapache2-mod-auth-openidc please refer to

its security tracker page at:
https://security-tracker.debian.org/tracker/libapache2-mod-auth-openid c

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Compass Security Schweiz AG discovered an issue in libapache2-mod-auth-openidc, an OpenID Connect authentication module for Apache. The OIDCRedirectURI page contains generated JavaScript code that uses a poll parameter as a string variable, thus might contain additional JavaScript code. This might result in Criss-Site Scripting (XSS).

For Debian 8 'Jessie', this problem has been fixed in version 1.6.0-1+deb8u1.

We recommend that you upgrade your libapache2-mod-auth-openidc packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
259761	Linux Distros Unpatched Vulnerability : CVE-2019-1010247	Nessus	Misc.	medium
139098	Debian DLA-2298-1 : libapache2-mod-auth-openidc security update	Nessus	Debian Local Security Checks	medium
128121	Debian DLA-1894-1 : libapache2-mod-auth-openidc security	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2019-1010247

medium

Tenable Plugins

medium

medium

medium