CVE-2017-6059
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka...
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
- Record
CVE-2017-6059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
- Record
CVE-2017-6059- Updated
- 2026-11-02
EUVDEUVD-2017-15127 No score
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
- Record
EUVD-2017-15127- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpc9-4cjr-9wxx
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka...
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
- Record
GHSA-rpc9-4cjr-9wxx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
- Record
CVE-2017-6059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-6059
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
- Record
DEBIAN-CVE-2017-6059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2019:2112
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2019:2112- CVSS 3.0
- 5.9 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-6059
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request.
- Record
UBUNTU-CVE-2017-6059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-auth-openidcDebian:12 |
before 2.1.5-1 | 2.1.5-1 |
libapache2-mod-auth-openidcDebian:13 |
before 2.1.5-1 | 2.1.5-1 |
libapache2-mod-auth-openidcDebian:14 |
before 2.1.5-1 | 2.1.5-1 |
mod_auth_openidcRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:1.8.8-5.el7 | 0:1.8.8-5.el7 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:1.8.8-5.el7 | 0:1.8.8-5.el7 |
mod_auth_openidcRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:1.8.8-5.el7 | 0:1.8.8-5.el7 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:1.8.8-5.el7 | 0:1.8.8-5.el7 |
libapache2-mod-auth-openidcUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.0-11.8.5-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-6059 is a high vulnerability (CVSS 7.5) in Openidc Mod Auth Openidc, published April 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.18%, the 92nd percentile. Fixed in libapache2-mod-auth-openidc 2.1.5-1.
References
github.com/pingidentity/mod_auth_openidc/issues/212
securityfocus.com/bid/96299
openwall.com/lists/oss-security/2017/02/17/6
access.redhat.com/errata/RHSA-2019:2112
Show 21 moreShow less
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPIINVFKKB4Z
nvd.nist.gov/vuln/detail/CVE-2017-6059
security-tracker.debian.org/tracker/CVE-2017-6059
bugzilla.redhat.com/show_bug.cgi?id=1425350
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2112.json
cve.org/CVERecord?id=CVE-2017-6059
ubuntu.com/security/CVE-2017-6059