CVE-2022-23527
Versions prior to 2.4.12.2 are vulnerable to Open Redirect.
Does this matter?
Lower severity and a low EPSS score (0.91%). Track it; it rarely justifies an emergency change on its own.
Description
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.91% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-601
- Affected
- openidc/mod auth openidc · debian/debian linux
- Source
- security-advisories@github.com
References
- https://github.com/zmartzone/mod_auth_openidc/blob/v2.4.12.1/auth_openidc.conf#L975-L984Product
- https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-q6f2-285m-gr53Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/07/msg00020.htmlMailing List
- https://github.com/zmartzone/mod_auth_openidc/blob/v2.4.12.1/auth_openidc.conf#L975-L984Product
- https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-q6f2-285m-gr53Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/07/msg00020.htmlMailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.