CVE-2019-13038

Published June 29th, 2019

View on NVD ↗

CVSS v3

6.1

MEDIUM

CVSS v2

4.3

MEDIUM

Affected

PROJECT

Description

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.

Uninett/mod_auth_mellon

An Apache module with a simple SAML 2.0 service provider

GitHub

210