CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-6413

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.004

EPSS Ranking 60.2%

CVSS Severity

CVSS v3 Score 8.6

CVSS v2 Score 5.0

References

Products affected by CVE-2017-6413

Openidc » Mod Auth Openidc » Version: N/A

cpe:2.3:a:openidc:mod_auth_openidc:-
Openidc » Mod Auth Openidc » Version: 1.5

cpe:2.3:a:openidc:mod_auth_openidc:1.5
Openidc » Mod Auth Openidc » Version: 1.5.1

cpe:2.3:a:openidc:mod_auth_openidc:1.5.1
Openidc » Mod Auth Openidc » Version: 1.5.2

cpe:2.3:a:openidc:mod_auth_openidc:1.5.2
Openidc » Mod Auth Openidc » Version: 1.5.3

cpe:2.3:a:openidc:mod_auth_openidc:1.5.3
Openidc » Mod Auth Openidc » Version: 1.5.4

cpe:2.3:a:openidc:mod_auth_openidc:1.5.4
Openidc » Mod Auth Openidc » Version: 1.5.5

cpe:2.3:a:openidc:mod_auth_openidc:1.5.5
Openidc » Mod Auth Openidc » Version: 1.6.0

cpe:2.3:a:openidc:mod_auth_openidc:1.6.0
Openidc » Mod Auth Openidc » Version: 1.7.0

cpe:2.3:a:openidc:mod_auth_openidc:1.7.0
Openidc » Mod Auth Openidc » Version: 1.7.1

cpe:2.3:a:openidc:mod_auth_openidc:1.7.1
Openidc » Mod Auth Openidc » Version: 1.7.2

cpe:2.3:a:openidc:mod_auth_openidc:1.7.2
Openidc » Mod Auth Openidc » Version: 1.7.3

cpe:2.3:a:openidc:mod_auth_openidc:1.7.3
Openidc » Mod Auth Openidc » Version: 1.8.0

cpe:2.3:a:openidc:mod_auth_openidc:1.8.0
Openidc » Mod Auth Openidc » Version: 1.8.1

cpe:2.3:a:openidc:mod_auth_openidc:1.8.1
Openidc » Mod Auth Openidc » Version: 1.8.10

cpe:2.3:a:openidc:mod_auth_openidc:1.8.10
Openidc » Mod Auth Openidc » Version: 1.8.10.1

cpe:2.3:a:openidc:mod_auth_openidc:1.8.10.1
Openidc » Mod Auth Openidc » Version: 1.8.10.2

cpe:2.3:a:openidc:mod_auth_openidc:1.8.10.2
Openidc » Mod Auth Openidc » Version: 1.8.10.3

cpe:2.3:a:openidc:mod_auth_openidc:1.8.10.3
Openidc » Mod Auth Openidc » Version: 1.8.2

cpe:2.3:a:openidc:mod_auth_openidc:1.8.2
Openidc » Mod Auth Openidc » Version: 1.8.3

cpe:2.3:a:openidc:mod_auth_openidc:1.8.3
Openidc » Mod Auth Openidc » Version: 1.8.4

cpe:2.3:a:openidc:mod_auth_openidc:1.8.4
Openidc » Mod Auth Openidc » Version: 1.8.5

cpe:2.3:a:openidc:mod_auth_openidc:1.8.5
Openidc » Mod Auth Openidc » Version: 1.8.6

cpe:2.3:a:openidc:mod_auth_openidc:1.8.6
Openidc » Mod Auth Openidc » Version: 1.8.7

cpe:2.3:a:openidc:mod_auth_openidc:1.8.7
Openidc » Mod Auth Openidc » Version: 1.8.8

cpe:2.3:a:openidc:mod_auth_openidc:1.8.8
Openidc » Mod Auth Openidc » Version: 1.8.9

cpe:2.3:a:openidc:mod_auth_openidc:1.8.9
Openidc » Mod Auth Openidc » Version: 2.0.0

cpe:2.3:a:openidc:mod_auth_openidc:2.0.0
Openidc » Mod Auth Openidc » Version: 2.1.0

cpe:2.3:a:openidc:mod_auth_openidc:2.1.0
Openidc » Mod Auth Openidc » Version: 2.1.1

cpe:2.3:a:openidc:mod_auth_openidc:2.1.1
Openidc » Mod Auth Openidc » Version: 2.1.2

cpe:2.3:a:openidc:mod_auth_openidc:2.1.2
Openidc » Mod Auth Openidc » Version: 2.1.3

cpe:2.3:a:openidc:mod_auth_openidc:2.1.3
Openidc » Mod Auth Openidc » Version: 2.1.4

cpe:2.3:a:openidc:mod_auth_openidc:2.1.4
Openidc » Mod Auth Openidc » Version: 2.1.5

cpe:2.3:a:openidc:mod_auth_openidc:2.1.5

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2017-6413

Products

Pricing

Contact Us