CVE-2021-39191: debian debian_linux Open Redirect

Vulnerability summary

CVE-2021-39191 is a medium (CVSS 6.1) Open Redirect vulnerability in debian debian_linux. EPSS estimates a 1.74% chance of exploitation in the next 30 days, higher than 77.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-09-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.

• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.