CVE-2019-3877

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-3877
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-3877.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-3877
Downstream
Published
2019-03-27T13:29:01Z
Modified
2025-09-19T11:09:21.767119Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A vulnerability was found in modauthmellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apruriparse function.

References

Affected packages

Git / github.com/uninett/mod_auth_mellon

Affected ranges

Type
GIT
Repo
https://github.com/uninett/mod_auth_mellon
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
62041428a32de402e0be6ba45fe12df6a83bedb8

Affected versions

v0.*

v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.13.1
v0.14.0
v0.14.1
v0.4.0
v0.5.0
v0.6.0
v0.6.0-rc1
v0.6.1
v0.7.0
v0.8.0
v0.9.0
v0.9.1

Database specific 

{
    "vanir_signatures": [
        {
            "deprecated": false,
            "target": {
                "file": "auth_mellon_util.c"
            },
            "source": "https://github.com/uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "32044419064285296566063656658415165029",
                    "21061309776983139534989088880159912311",
                    "28373241189536936529294675472970530512",
                    "210226503878164329466142730749373246164"
                ]
            },
            "id": "CVE-2019-3877-2744b448",
            "signature_version": "v1",
            "signature_type": "Line"
        },
        {
            "deprecated": false,
            "target": {
                "function": "am_check_url",
                "file": "auth_mellon_util.c"
            },
            "source": "https://github.com/uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8",
            "digest": {
                "function_hash": "279795152569979611241225697117366206789",
                "length": 298.0
            },
            "id": "CVE-2019-3877-f30d3048",
            "signature_version": "v1",
            "signature_type": "Function"
        }
    ]
}