CVE-2017-6062 in mod_auth_openidc
Summary
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Reservation
02/17/2017
Disclosure
03/02/2017
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 97455 | mod_auth_openidc improper authentication | 287 | Not defined | Official fix | CVE-2017-6062 |