The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a     mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for     disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any     application-level gateway (or load balancer etc) protecting the server. When you request a protected     resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-     submitting form), and the protected resource (with no headers). This is an example of a request for a     protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it     has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try     to issue the protected resource. oidc_content_handler is called early, which has the opportunity to     prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it     intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd     appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >=     2.4.16.11. (CVE-2025-31492)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2025-31492

high Nessus Plugin ID 234195

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Apr 28, 2025, 4:40 PM IAVM reference (Remove IAVM references from unpatched plugins) Plugin Feed: 202504281640
Version 1.2 Apr 18, 2025, 9:45 PM Plugin metadata (Add IAVM info) Plugin Feed: 202504182145
Version 1.1 Apr 11, 2025, 8:06 PM New Plugin Feed: 202504112006