Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
0

CVE-2019-3878

Disclosure Date: March 26, 2019 •
CVE-2019-3878
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
None
Impact Score:
Unknown
Exploitability Score:
Unknown
Vector:
Unknown
Attack Vector (AV):
Unknown
Attack Complexity (AC):
Unknown
Privileges Required (PR):
Unknown
User Interaction (UI):
Unknown
Scope (S):
Unknown
Confidentiality (C):
Unknown
Integrity (I):
Unknown
Availability (A):
Unknown

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
mod_auth_mellon before v0.14.2
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • canonical,
  • fedoraproject,
  • mod auth mellon project,
  • redhat

Products

  • enterprise linux 7.0,
  • enterprise linux desktop 7.0,
  • enterprise linux server 7.0,
  • enterprise linux server aus 7.6,
  • enterprise linux server eus 7.6,
  • enterprise linux server tus 7.6,
  • enterprise linux workstation 7.0,
  • fedora 29,
  • fedora 30,
  • mod auth mellon,
  • ubuntu linux 18.04,
  • ubuntu linux 18.10
Technical Analysis