Lucene search
PRIOn knowledge basePRION:CVE-2022-23527HistoryDec 14, 2022 - 6:15 p.m.
Open redirect
2022-12-1418:15:00
PRIOn knowledge base
www.prio-n.com
8
mod_auth_openidc
open redirect
apache 2.x
vulnerable
patched
oidc_validate_redirect_url
regular expression
mitigation
nvd
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
| CPE | Name | Operator | Version |
|---|---|---|---|
| debian_linux | eq | 10.0 | |
| mod_auth_openidc | lt | 2.4.12.2 |
Related
osv
osv
CVE-2022-23527
2022-12-14 18:15:20
Moderate: mod_auth_openidc security and bug fix update
2023-11-07 00:00:00
libapache2-mod-auth-openidc - security update
2023-07-19 00:00:00
cbl_mariner
cbl_mariner
cvelist
cvelist
CVE-2022-23527 Open Redirect in oidc_validate_redirect_url()
2022-12-14 17:22:30
nessus
nessus
Fedora 36 : mod_auth_openidc (2022-6beaa3bd0c)
2022-12-25 00:00:00
Oracle Linux 9 : mod_auth_openidc (ELSA-2023-6365)
2023-11-16 00:00:00
RHEL 8 : mod_auth_openidc:2.3 (RHSA-2023:6940)
2023-11-14 00:00:00
nvd
nvd
CVE-2022-23527
2022-12-14 18:15:20
fedora
fedora
[SECURITY] Fedora 36 Update: mod_auth_openidc-2.4.12.2-1.fc36
2022-12-25 01:22:44
[SECURITY] Fedora 37 Update: mod_auth_openidc-2.4.12.2-1.fc37
2022-12-25 01:08:49
openvas
openvas
Fedora: Security Advisory for mod_auth_openidc (FEDORA-2022-e139408490)
2022-12-25 00:00:00
Fedora: Security Advisory for mod_auth_openidc (FEDORA-2022-6beaa3bd0c)
2022-12-25 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:0215-1)
2023-01-31 00:00:00
cve
cve
CVE-2022-23527
2022-12-14 18:15:20
redhatcve
redhatcve
CVE-2022-23527
2022-12-15 04:04:44
veracode
veracode
Open Redirect
2022-12-20 09:04:10
ubuntucve
ubuntucve
CVE-2022-23527
2022-12-14 00:00:00
debiancve
debiancve
CVE-2022-23527
2022-12-14 18:15:20
almalinux
almalinux
Moderate: mod_auth_openidc security and bug fix update
2023-11-07 00:00:00
Moderate: mod_auth_openidc:2.3 security and bug fix update
2023-11-14 00:00:00
oraclelinux
oraclelinux
mod_auth_openidc security and bug fix update
2023-11-11 00:00:00
mod_auth_openidc:2.3 security and bug fix update
2023-11-18 00:00:00
redhat
redhat
(RHSA-2023:6365) Moderate: mod_auth_openidc security and bug fix update
2023-11-07 06:03:12
(RHSA-2023:6940) Moderate: mod_auth_openidc:2.3 security and bug fix update
2023-11-14 08:40:59
debian
debian
[SECURITY] [DLA 3499-1] libapache2-mod-auth-openidc security update
2023-07-18 22:51:29