Skip to content
OpenAdvisories
Unscored CVE-2019-1010247 EUVD-2019-1989GHSA-xp9w-hvv3-f7rw

ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a ph…

Published Jul 19, 2019 · Updated Aug 5, 2024 · Assigned by dwf

Vendor: ZmartZone IAM Product: mod_auth_openidc Package: libapache2-mod-auth-openidc Package: libapache2-mod-auth-openidc Ecosystem: Debian Ecosystem: Ubuntu

Description

ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.

Affected products

VendorProductAffectedFixed
ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier [fixed: 2.3.10.2] —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libapache2-mod-auth-openidc 2.3.10.2-1 —
Debian 13 libapache2-mod-auth-openidc 2.3.10.2-1 —
Debian 12 libapache2-mod-auth-openidc 2.3.10.2-1 —
Debian 9 libapache2-mod-auth-openidc 2.1.6-1+deb9u1 DLA-2298-1
Debian 8 libapache2-mod-auth-openidc 1.6.0-1+deb8u1 DLA-1894-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libapache2-mod-auth-openidc No fix yet —
Ubuntu 16.04 LTS libapache2-mod-auth-openidc No fix yet —

Advisories 2

References