mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-06-29T00:00:00

Updated: 2024-08-04T23:41:10.031Z

Reserved: 2019-06-29T00:00:00

Link: CVE-2019-13038

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-06-29T14:15:09.150

Modified: 2024-11-21T04:24:05.537

Link: CVE-2019-13038

cve-icon Redhat

Severity : Moderate

Publid Date: 2019-06-20T00:00:00Z

Links: CVE-2019-13038 - Bugzilla