CVE-2017-6807

EUVD-2017-15861
mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
Affected Products (NVD)
VendorProductVersion
uninettmod_auth_mellon
𝑥
≤ 0.13.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libapache2-mod-auth-mellon
bookworm
0.18.1-1
fixed
bullseye
0.17.0-1+deb11u1
fixed
jessie
no-dsa
sid
0.19.1-1
fixed
trixie
0.19.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libapache2-mod-auth-mellon
artful
not-affected
bionic
not-affected
cosmic
not-affected
disco
not-affected
eoan
not-affected
focal
not-affected
groovy
not-affected
precise
dne
trusty
dne
xenial
Fixed 0.12.0-2+deb9u1build0.16.04.1
released
yakkety
ignored
zesty
ignored
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/96843
https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1
https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html
http://www.securityfocus.com/bid/96843
https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1
https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html