CVE-2019-3878CWE-305

A vulnerability was found in mod_auth_mellon before v0.14.2

High · published March 26, 2019

CVSS v3.0
8.1
EPSS
3%
Percentile
87.1
In the wild
Unconfirmed
What it is

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02969 · 87.1th percentile
Weakness
CWE-305 · Authentication Bypass by Primary Weakness
Published
2019-03-26T17:44Z
EPSS history
Timeline
  • 26 MAR 17:44Z
    A vulnerability was found in mod_auth_mellon before v0.14.2
    cvelistv5