Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc
Vulnerability Description
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Vulnerability Title
mod_auth_openidc 输入输入验证错误漏洞
Vulnerability Description
mod_auth_openidc是一个应用软件。是 Apache 2.x HTTP 服务器的身份验证/授权模块，用作OpenID Connect 依赖方，根据 OpenID Connect 提供程序对用户进行身份验证。 mod_auth_openidc是Apache2.x HTTP服务器的身份验证/授权模块，作为OpenID连接依赖方，根据OpenID连接提供程序对用户进行身份验证。mod_auth_openidc 2.4.9.4之前的版本存在输入验证错误漏洞,该漏洞源于第三方初始化SSO功能容易受到开放
CVSS Information
N/A
Vulnerability Type
N/A