CVE-2021-32792lowCWE-79

CVE-2021-32792: low-severity vulnerability in zmartzone mod_auth_openidc

XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc

Published · Updated

Follow this CVE+ Monitor mod auth openidc+ Monitor libapache2-mod-auth-openidc

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.1epss 1.5%
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
zmartzone · mod_auth_openidc
Related CVEs — zmartzone mod_auth_openidc

In the same product, most dangerous first.

CVE-2021-32785MEDIUMFormat string bug in the Redis cache implementationEPSS 2.7%CVE-2021-32786MEDIUMOpen Redirect in oidc_validate_redirect_url()EPSS 2.4%CVE-2021-39191MEDIUMURL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidcEPSS 1.7%CVE-2021-32791MEDIUMHardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidcEPSS 1.5%CVE-2022-23527MEDIUMOpen Redirect in oidc_validate_redirect_url()EPSS 0.9%