mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1660 advisory.

    - Resolves: rhbz#1731053 - CVE-2019-13038 mod_auth_mellon: an Open Redirect                                via the login?ReturnTo= substring which could                                facilitate information theft [rhel-8]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1003 advisory.

    - Resolves: rhbz#1731052 - CVE-2019-13038 mod_auth_mellon: an Open Redirect via                                the login?ReturnTo= substring which could facilitate                                information theft [rhel-7]
    - Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect                                in logout url when using URLs with backslashes                                [rhel-7]
    - Resolves: rhbz#1692470 - CVE-2019-3877 mod_auth_mellon: open redirect                                in logout url when using URLs with backslashes                                [rhel-7]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3359 advisory.

  - mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by     omitting the // after http: in the target URL. (CVE-2019-13038)

  - A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be     used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web     application URL that redirects to an external and potentially malicious server. The highest threat from     this liability is to confidentiality and integrity. (CVE-2021-3639)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the mod_auth_mellon package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by     omitting the // after http: in the target URL. (CVE-2019-13038)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jakub Hrozek reports :

Version 0.17.0 and older of mod_auth_mellon allows the redirect URL validation to be bypassed by specifying an URL formatted as ///fishing-site.example.com/logout.html

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:1660 advisory.

  - mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft     (CVE-2019-13038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has mod_auth_mellon packages installed that are affected by a vulnerability:

  - mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by     omitting the // after http: in the target URL. (CVE-2019-13038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has mod_auth_mellon packages installed that are affected by a vulnerability:

  - mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by     omitting the // after http: in the target URL. (CVE-2019-13038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1660 advisory.

    The mod_auth_mellon module for the Apache HTTP Server is an authentication service that implements the     SAML 2.0 federation protocol. The module grants access based on the attributes received in assertions     generated by an IdP server.

    Security Fix(es):

    * mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information     theft (CVE-2019-13038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.01, has mod_auth_mellon packages installed that are affected by a vulnerability:

  - mod_auth_mellon through 0.14.2 has an Open Redirect via     the login?ReturnTo= substring, as demonstrated by     omitting the // after http: in the target URL.
    (CVE-2019-13038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mod_auth_mellon installed on the remote host is prior to 0.14.0-8. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1436 advisory.

    mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by     omitting the // after http: in the target URL. (CVE-2019-13038)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

* mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1003 advisory.

  - mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by     omitting the // after http: in the target URL. (CVE-2019-13038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1003 advisory.

    The mod_auth_mellon module for the Apache HTTP Server is an authentication service that implements the     SAML 2.0 federation protocol. The module grants access based on the attributes received in assertions     generated by an IdP server.

    Security Fix(es):

    * mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information     theft (CVE-2019-13038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4291-1 advisory.

    It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly     use this issue to redirect a user to a malicious URL.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mod24_auth_mellon installed on the remote host is prior to 0.14.0-2.9. The version of mod_auth_mellon installed on the remote host is prior to 0.13.1-1.6. It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1331 advisory.

    mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by     omitting the // after http: in the target URL.(CVE-2019-13038)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fixes a CVE: CVE-2019-13038 mod_auth_mellon: an Open Redirect via the login?ReturnTo= substring which could facilitate information theft

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
195521	RHEL 6 : mod_auth_mellon (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
180894	Oracle Linux 8 : mod_auth_mellon (ELSA-2020-1660)	Nessus	Oracle Linux Local Security Checks	medium
180686	Oracle Linux 7 : mod_auth_mellon (ELSA-2020-1003)	Nessus	Oracle Linux Local Security Checks	medium
172487	Debian DLA-3359-1 : libapache2-mod-auth-mellon - LTS security update	Nessus	Debian Local Security Checks	medium
162346	EulerOS 2.0 SP5 : mod_auth_mellon (EulerOS-SA-2022-1903)	Nessus	Huawei Local Security Checks	medium
153823	FreeBSD : mod_auth_mellon -- Redirect URL validation bypass (7bba5b3b-1b7f-11ec-b335-d4c9ef517024)	Nessus	FreeBSD Local Security Checks	medium
145842	CentOS 8 : mod_auth_mellon (CESA-2020:1660)	Nessus	CentOS Local Security Checks	medium
145702	NewStart CGSL CORE 5.05 / MAIN 5.05 : mod_auth_mellon Vulnerability (NS-SA-2020-0106)	Nessus	NewStart CGSL Local Security Checks	medium
143985	NewStart CGSL CORE 5.04 / MAIN 5.04 : mod_auth_mellon Vulnerability (NS-SA-2020-0072)	Nessus	NewStart CGSL Local Security Checks	medium
143031	RHEL 8 : mod_auth_mellon (RHSA-2020:1660)	Nessus	Red Hat Local Security Checks	medium
138779	NewStart CGSL MAIN 6.01 : mod_auth_mellon Vulnerability (NS-SA-2020-0034)	Nessus	NewStart CGSL Local Security Checks	medium
137567	Amazon Linux 2 : mod_auth_mellon (ALAS-2020-1436)	Nessus	Amazon Linux Local Security Checks	medium
135822	Scientific Linux Security Update : mod_auth_mellon on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	medium
135314	CentOS 7 : mod_auth_mellon (RHSA-2020:1003)	Nessus	CentOS Local Security Checks	medium
135035	RHEL 7 : mod_auth_mellon (RHSA-2020:1003)	Nessus	Red Hat Local Security Checks	medium
134038	Ubuntu 18.04 LTS : mod-auth-mellon vulnerability (USN-4291-1)	Nessus	Ubuntu Local Security Checks	medium
132755	Amazon Linux AMI : mod_auth_mellon, mod24_auth_mellon (ALAS-2020-1331)	Nessus	Amazon Linux Local Security Checks	medium
131464	Fedora 30 : mod_auth_mellon (2019-e8d74ece30)	Nessus	Fedora Local Security Checks	medium
131441	Fedora 31 : mod_auth_mellon (2019-1444823e77)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2019-13038

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium