{"id":"CVE-2019-3878","aliases":["DEBIAN-CVE-2019-3878","DSA-4414-1","EUVD-2019-13489","GHSA-6gx9-985p-w8c8","RHSA-2019:0746","RHSA-2019:0766","RHSA-2019:0985","UBUNTU-CVE-2019-3878","USN-3924-1","USN-4597-1"],"status":"published","title":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse...","description":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.02969,"percentile":0.87331,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-305"],"published":"2019-03-21T00:00:00Z","modified":"2026-10-20T10:50:55Z","fixes":[{"ecosystem":"Debian:12","package":"libapache2-mod-auth-mellon","fixed_in":["0.14.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-auth-mellon","fixed_in":["0.14.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-auth-mellon","fixed_in":["0.14.2-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon","fixed_in":["0:0.14.0-3.el8_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-debuginfo","fixed_in":["0:0.14.0-3.el8_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-debugsource","fixed_in":["0:0.14.0-3.el8_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-diagnostics-debuginfo","fixed_in":["0:0.14.0-3.el8_0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-auth-mellon","fixed_in":["0.12.0-2+deb9u1build0.16.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-mellon","fixed_in":["0.13.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-mellon","fixed_in":["0.14.2-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-2+deb9u1"}]}],"versions":["0.12.0-2"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.1-2.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_auth_mellon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.13.1-2.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.34-7.el7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-2.el7_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_auth_mellon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-2.el7_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_auth_mellon-diagnostics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-2.el7_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-2.el7_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_auth_mellon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-2.el7_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_auth_mellon-diagnostics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-2.el7_6.4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el8_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el8_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el8_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-diagnostics-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-3.el8_0.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-2+deb9u1build0.16.04.1"}]}],"versions":["0.10.0-1","0.11.0-1","0.12.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-1ubuntu0.1"}]}],"versions":["0.13.1-1","0.13.1-1build1","0.13.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.2-1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-1ubuntu0.1"}]}],"versions":["0.13.1-1","0.13.1-1build1","0.13.1-1build2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-2+deb9u1build0.16.04.1"}]}],"versions":["0.10.0-1","0.11.0-1","0.12.0-1"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mod_auth_mellon_project","product":"mod_auth_mellon"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"uninett","product":"mod_auth_mellon"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/Uninett/mod_auth_mellon/pull/196","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","fix","article","report"]},{"url":"https://usn.ubuntu.com/3924-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0746","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0766","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0985","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2019:0959","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3878","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"},{"url":"https://github.com/advisories/GHSA-6gx9-985p-w8c8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3878","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691126","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1694980","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0746.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0211","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0211","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0211","tags":["advisory"]},{"url":"http://www.apache.org/dist/httpd/CHANGES_2.4","tags":["article"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-0211","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3878","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3878","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1697487","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0766.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3877","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0985.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3878","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3924-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4597-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3877","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6807","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-3878","description":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.","status":"published","published":"2019-03-26T17:44:29Z","modified":"2024-08-04T19:19:18.665Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13489","description":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.","status":"published","published":"2019-03-26T17:44:29Z","modified":"2024-08-04T19:19:18Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:06:54.939848Z"}],"ghsa":[{"id":"GHSA-6gx9-985p-w8c8","title":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse...","description":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.","status":"published","published":"2022-05-14T01:05:27Z","modified":"2023-02-02T05:03:02Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:51:33.40906Z"}],"nvd":[{"id":"CVE-2019-3878","description":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.","status":"published","published":"2019-03-26T18:29:00.983Z","modified":"2026-06-17T02:35:47.417Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-305","CWE-287"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-3878","description":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.","status":"published","published":"2019-03-26T18:29:00.983Z","modified":"2026-10-20T10:50:55.598400782Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3878","description":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.","status":"published","published":"2019-03-26T18:29:00.983Z","modified":"2026-09-21T07:01:03.910847314Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2019:0746","title":"Red Hat Security Advisory: httpd24-httpd and httpd24-mod_auth_mellon security update","status":"published","published":"2024-09-13T19:49:48Z","modified":"2026-09-21T10:02:07Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:0766","title":"Red Hat Security Advisory: mod_auth_mellon security and bug fix update","status":"published","published":"2024-09-16T02:23:11Z","modified":"2026-06-29T10:24:07Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2019:0985","title":"Red Hat Security Advisory: mod_auth_mellon security update","status":"published","published":"2024-09-13T14:08:34Z","modified":"2026-06-29T10:24:16Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2019-3878","description":"A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.","status":"published","published":"2019-03-21T00:00:00Z","modified":"2026-02-04T04:14:39.666668Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"DSA-4414-1","title":"libapache2-mod-auth-mellon - security update","status":"published","published":"2019-03-23T00:00:00Z","modified":"2026-03-09T02:09:13.443675Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"USN-3924-1","title":"libapache2-mod-auth-mellon vulnerabilities","description":"It was discovered that mod_auth_mellon incorrectly handled certain requests.\nAn attacker could possibly use this issue to redirect a user to a malicious\nURL. (CVE-2019-3877)\n\nIt was discovered that mod_auth_mellon incorrectly handled certain requests.\nAn attacker could possibly use this issue to access sensitive information.\n(CVE-2019-3878)\n","status":"published","published":"2019-03-28T13:24:30Z","modified":"2026-02-10T04:41:29Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4597-1","title":"libapache2-mod-auth-mellon vulnerabilities","description":"François Kooman discovered that mod_auth_mellon incorrectly handled\ncookies. An attacker could possibly use this issue to cause a Cross-Site\nSession Transfer attack. (CVE-2017-6807)\n\nIt was discovered that mod_auth_mellon incorrectly handled certain requests.\nAn attacker could possibly use this issue to redirect a user to a malicious\nURL. (CVE-2019-3877)\n\nIt was discovered that mod_auth_mellon incorrectly handled certain requests.\nAn attacker could possibly use this issue to access sensitive information.\n(CVE-2019-3878)\n","status":"published","published":"2020-10-22T12:47:17Z","modified":"2026-02-10T04:41:58Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}