Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in
Mod Auth Mellon ProjectMod Auth Mellon*

2 matches found

CVE
CVE•added 2019/03/26 5:44 p.m.•152 views

CVE-2019-3878

The CVE-2019-3878 issue affects mod_auth_mellon for Apache before v0.14.2. When Apache runs as a reverse proxy and mod_auth_mellon is set to require valid-user, an attacker can bypass authentication by sending specific HTTP headers used in SAML ECP (non-browser) flows. The connected advisories in...

8.1CVSS7.7AI score0.02969EPSS
CVE
CVE•added 2019/03/27 12:19 p.m.•127 views

CVE-2019-3877

CVE-2019-3877 affects mod_auth_mellon before v0.14.2. An open redirect in the logout URL can be bypassed when URLs contain backslashes, since browsers convert them to forward slashes and treat the URL as absolute, bypassing apr_uri_parse validation. Remediation per connected advisories is to upgr...

6.1CVSS6.6AI score0.02131EPSS