CVE-2019-3877
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL...
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
- Record
CVE-2019-3877- CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2019-13488
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
- Record
EUVD-2019-13488- CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qr9h-f4fq-2h85
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL...
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
- Record
GHSA-qr9h-f4fq-2h85- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
- Record
CVE-2019-3877- CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
- Record
CVE-2019-3877- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-3877
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
- Record
DEBIAN-CVE-2019-3877- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2019:0766
Red Hat Security Advisory: mod_auth_mellon security and bug fix update
- Record
RHSA-2019:0766- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2019:3421
Red Hat Security Advisory: mod_auth_mellon security, bug fix, and enhancement update
- Record
RHSA-2019:3421- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-3877
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
- Record
UBUNTU-CVE-2019-3877- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.0
- 5.8 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUSN-3924-1 No score
libapache2-mod-auth-mellon vulnerabilities
It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. (CVE-2019-3877)
It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to access sensitive information. (CVE-2019-3878)
- Record
USN-3924-1- Updated
- 2026-11-02
OSVUSN-4597-1 No score
libapache2-mod-auth-mellon vulnerabilities
François Kooman discovered that mod_auth_mellon incorrectly handled cookies. An attacker could possibly use this issue to cause a Cross-Site Session Transfer attack. (CVE-2017-6807)
It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. (CVE-2019-3877)
It was discovered that mod_auth_mellon incorrectly handled certain requests. An attacker could possibly use this issue to access sensitive information. (CVE-2019-3878)
- Record
USN-4597-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-auth-mellonDebian:12 |
before 0.14.2-1 | 0.14.2-1 |
libapache2-mod-auth-mellonDebian:13 |
before 0.14.2-1 | 0.14.2-1 |
libapache2-mod-auth-mellonDebian:14 |
before 0.14.2-1 | 0.14.2-1 |
libapache2-mod-auth-mellonDebian:9 From an advisory covering 2 CVEs |
before 0.12.0-2+deb9u1, plus listed versions 0.12.0-2 |
0.12.0-2+deb9u1 |
mod_auth_mellonRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:0.14.0-2.el7_6.4 | 0:0.14.0-2.el7_6.4 |
mod_auth_mellon-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:0.14.0-2.el7_6.4 | 0:0.14.0-2.el7_6.4 |
mod_auth_mellon-diagnosticsRed Hat:enterprise_linux:7::server From an advisory covering 2 CVEs |
before 0:0.14.0-2.el7_6.4 | 0:0.14.0-2.el7_6.4 |
mod_auth_mellonRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:0.14.0-2.el7_6.4 | 0:0.14.0-2.el7_6.4 |
mod_auth_mellon-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:0.14.0-2.el7_6.4 | 0:0.14.0-2.el7_6.4 |
mod_auth_mellon-diagnosticsRed Hat:enterprise_linux:7::workstation From an advisory covering 2 CVEs |
before 0:0.14.0-2.el7_6.4 | 0:0.14.0-2.el7_6.4 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_auth_mellonRed Hat:enterprise_linux:8::appstream |
before 0:0.14.0-9.el8 | 0:0.14.0-9.el8 |
mod_auth_mellon-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:0.14.0-9.el8 | 0:0.14.0-9.el8 |
mod_auth_mellon-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:0.14.0-9.el8 | 0:0.14.0-9.el8 |
mod_auth_mellon-diagnosticsRed Hat:enterprise_linux:8::appstream |
before 0:0.14.0-9.el8 | 0:0.14.0-9.el8 |
mod_auth_mellon-diagnostics-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:0.14.0-9.el8 | 0:0.14.0-9.el8 |
libapache2-mod-auth-mellonUbuntu:16.04:LTS |
before 0.12.0-2+deb9u1build0.16.04.1, plus listed versions 0.10.0-10.11.0-10.12.0-1 |
0.12.0-2+deb9u1build0.16.04.1 |
libapache2-mod-auth-mellonUbuntu:18.04:LTS |
before 0.13.1-1ubuntu0.1, plus listed versions 0.13.1-10.13.1-1build10.13.1-1build2 |
0.13.1-1ubuntu0.1 |
libapache2-mod-auth-mellonUbuntu:20.04:LTS |
before 0.14.2-1ubuntu1 | 0.14.2-1ubuntu1 |
libapache2-mod-auth-mellonUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 0.13.1-1ubuntu0.1, plus listed versions 0.13.1-10.13.1-1build10.13.1-1build2 |
0.13.1-1ubuntu0.1 |
libapache2-mod-auth-mellonUbuntu:16.04:LTS From an advisory covering 3 CVEs |
before 0.12.0-2+deb9u1build0.16.04.1, plus listed versions 0.10.0-10.11.0-10.12.0-1 |
0.12.0-2+deb9u1build0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3877 is a medium vulnerability (CVSS 5.8) in Canonical Ubuntu Linux, published March 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.12%, the 81st percentile. Fixed in libapache2-mod-auth-mellon 0.14.2-1.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877
github.com/Uninett/mod_auth_mellon/issues/35
usn.ubuntu.com/3924-1
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ
Show 27 moreShow less
access.redhat.com/errata/RHSA-2019:0766
nvd.nist.gov/vuln/detail/CVE-2019-3877
security-tracker.debian.org/tracker/CVE-2019-3877
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0766.json
cve.org/CVERecord?id=CVE-2019-3877
ubuntu.com/security/CVE-2019-3877