{"id":"CVE-2021-3639","aliases":["ALSA-2022:1934","AZL-10651","AZL-36962","DEBIAN-CVE-2021-3639","DLA-3359-1","EUVD-2021-26939","GHSA-mhcv-7w89-jjj5","RHSA-2022:1934","RLSA-2022:1934","SUSE-SU-2021:2912-1","SUSE-SU-2022:1524-1","UBUNTU-CVE-2021-3639","USN-5069-1","openSUSE-SU-2024:13848-1"],"status":"published","title":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue...","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01061,"percentile":0.65007,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2021-08-04T00:00:00Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"mod_auth_mellon","fixed_in":["0.14.0-12.el8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"mod_auth_mellon-diagnostics","fixed_in":["0.14.0-12.el8.1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"mod_auth_mellon","fixed_in":["0.16.0-4"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"mod_auth_mellon","fixed_in":["0.16.0-4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libapache2-mod-auth-mellon","fixed_in":["0.18.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-auth-mellon","fixed_in":["0.18.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-auth-mellon","fixed_in":["0.18.0-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon","fixed_in":["0:0.14.0-12.el8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-debuginfo","fixed_in":["0:0.14.0-12.el8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-debugsource","fixed_in":["0:0.14.0-12.el8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-diagnostics","fixed_in":["0:0.14.0-12.el8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-diagnostics-debuginfo","fixed_in":["0:0.14.0-12.el8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"mod_auth_mellon","fixed_in":["0:0.14.0-12.el8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_auth_mellon","fixed_in":["0.16.0-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_auth_mellon","fixed_in":["0.16.0-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"apache2-mod_auth_mellon","fixed_in":["0.17.0-150200.5.7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-mellon","fixed_in":["0.13.1-1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-mellon","fixed_in":["0.16.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libapache2-mod-auth-mellon","fixed_in":["0.17.0-1ubuntu1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_auth_mellon","fixed_in":["0.19.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-12.el8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"mod_auth_mellon-diagnostics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-12.el8.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.2-1+deb10u1"}]}],"versions":["0.14.2-1"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-12.el8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-12.el8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-12.el8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-diagnostics","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-12.el8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_mellon-diagnostics-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-12.el8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.14.0-12.el8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150200.5.7.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-1","0.11.0-1","0.12.0-1","0.12.0-2+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-1ubuntu0.3"}]}],"versions":["0.13.1-1","0.13.1-1build1","0.13.1-1build2","0.13.1-1ubuntu0.1","0.13.1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-1ubuntu0.1"}]}],"versions":["0.14.2-1ubuntu1","0.14.2-1ubuntu2","0.16.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-1ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.13.1-1ubuntu0.3"}]}],"versions":["0.13.1-1","0.13.1-1build1","0.13.1-1build2","0.13.1-1ubuntu0.1","0.13.1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0-1ubuntu0.1"}]}],"versions":["0.14.2-1ubuntu1","0.14.2-1ubuntu2","0.16.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_auth_mellon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.0-1.1"}]}]}],"products":[{"vendor":"uninett","product":"mod_auth_mellon"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980648","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3639","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/latchset/mod_auth_mellon/commit/42a11261b9dad2e48d70bdff7c53dd57a12db6f5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3639","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1934","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mhcv-7w89-jjj5"},{"url":"https://errata.almalinux.org/8/ALSA-2022-1934.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-3639","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3639","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1934.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3639","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:1934","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212912-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188926","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3639","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221524-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3639","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5069-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5069-2","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-3639","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","status":"published","published":"2022-08-22T14:49:03Z","modified":"2024-08-03T17:01:07.702Z","cwes":["CWE-601"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26939","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","status":"published","published":"2022-08-22T14:49:03Z","modified":"2024-08-03T17:01:07Z","updated_at":"2026-11-03T03:25:12.535968Z"}],"ghsa":[{"id":"GHSA-mhcv-7w89-jjj5","title":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue...","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","status":"published","published":"2022-08-23T00:00:17Z","modified":"2023-02-02T21:33:39Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:52:47.451891Z"}],"nvd":[{"id":"CVE-2021-3639","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","status":"published","published":"2022-08-22T15:15:13.633Z","modified":"2026-06-17T04:05:29.293Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"AZL-10651","title":"CVE-2021-3639 affecting package mod_auth_mellon for versions less than 0.16.0-4","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","status":"published","published":"2022-08-22T15:15:13Z","modified":"2026-04-21T04:20:50.10178Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:01.408755Z"},{"id":"AZL-36962","title":"CVE-2021-3639 affecting package mod_auth_mellon for versions less than 0.16.0-4","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","status":"published","published":"2022-08-22T15:15:13Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"CVE-2021-3639","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","status":"published","published":"2022-08-22T15:15:13.633Z","modified":"2026-10-24T14:25:15.456660643Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-3639","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","status":"published","published":"2022-08-22T15:15:13.633Z","modified":"2026-10-23T18:04:50.917292623Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"RHSA-2022:1934","title":"Red Hat Security Advisory: mod_auth_mellon security update","status":"published","published":"2024-09-16T07:08:39Z","modified":"2025-11-22T12:33:35Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:1934","title":"Moderate: mod_auth_mellon security update","description":"The mod_auth_mellon module for the Apache HTTP Server is an authentication service that implements the SAML 2.0 federation protocol. The module grants access based on the attributes received in assertions generated by an IdP server.\n\nSecurity Fix(es):\n\n* mod_auth_mellon: Open Redirect vulnerability in logout URLs (CVE-2021-3639)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:08:25Z","modified":"2026-02-04T10:30:05.639967Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-3639","description":"A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.","status":"published","published":"2021-08-04T00:00:00Z","modified":"2026-02-04T03:40:54.478355Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"ALSA-2022:1934","title":"Moderate: mod_auth_mellon security update","description":"The mod_auth_mellon module for the Apache HTTP Server is an authentication service that implements the SAML 2.0 federation protocol. The module grants access based on the attributes received in assertions generated by an IdP server.\n\nSecurity Fix(es):\n\n* mod_auth_mellon: Open Redirect vulnerability in logout URLs (CVE-2021-3639)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T08:08:25Z","modified":"2026-10-29T11:01:16.48032299Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-3359-1","title":"libapache2-mod-auth-mellon - security update","status":"published","published":"2023-03-13T00:00:00Z","modified":"2026-03-09T01:17:52.403928Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"openSUSE-SU-2024:13848-1","title":"apache2-mod_auth_mellon-0.19.0-1.1 on GA media","description":"These are all security issues fixed in the apache2-mod_auth_mellon-0.19.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:29:38.431151Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2021:2912-1","title":"Security update for apache2-mod_auth_mellon","description":"This update for apache2-mod_auth_mellon fixes the following issues:\n\n- CVE-2021-3639: Fixed Open Redirect vulnerability in logout URLs (bsc#1188926).\n","status":"published","published":"2021-09-02T07:51:07Z","modified":"2026-02-04T04:24:41.824417Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:1524-1","title":"Security update for apache2-mod_auth_mellon","description":"This update for apache2-mod_auth_mellon fixes the following issues:\n\n- CVE-2021-3639: Fixed open Redirect vulnerability in logout URLs (bsc#1188926)\n","status":"published","published":"2022-05-04T11:46:54Z","modified":"2026-02-04T02:59:37.459376Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5069-1","title":"libapache2-mod-auth-mellon vulnerability","description":"It was discovered that mod-auth-mellon incorrectly filtered certain URLs.\nA remote attacker could possibly use this issue to perform an open redirect\nattack.\n","status":"published","published":"2021-09-08T11:46:56Z","modified":"2026-04-27T15:55:04.487057Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}