OpenIDC records

15 published records for vendor openidc.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 100%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

15 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2017-6413No exploit	The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does openidc · mod auth openidc · CWE-287 Pre-auth Auth bypass	High8.6	—	4.2%	Mar 2, 2017
35Monitor	CVE-2017-6062No exploit	The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does openidc · mod auth openidc · CWE-287 Pre-auth Auth bypass	High8.6	—	3.6%	Mar 2, 2017
32Monitor	CVE-2017-6059No exploit	Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote attopenidc · mod auth openidc · CWE-20 Pre-auth	High7.5	—	5.1%	Apr 12, 2017
31Monitor	CVE-2021-20718No exploit	mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.openidc · mod auth openidc · CWE-400 Pre-auth Denial of service	High7.5	—	3.3%	May 19, 2021
31Monitor	CVE-2021-32785No exploit	Format string bug in the Redis cache implementationopenidc · mod auth openidc · CWE-134 pre-auth RCE Denial of service	High7.5	—	2.7%	Jul 22, 2021
30Monitor	CVE-2023-28625No exploit	mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is suppliedopenidc · mod auth openidc · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	1.3%	Apr 3, 2023
30Monitor	CVE-2024-24814No exploit	Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidcopenidc · mod auth openidc · CWE-400 Pre-auth Denial of service	High7.5	—	1.2%	Feb 13, 2024
25Monitor	CVE-2021-32786No exploit	Open Redirect in oidc_validate_redirect_url()openidc · mod auth openidc · CWE-601 Pre-auth Open redirect	Medium6.1	—	2.3%	Jul 22, 2021
25Monitor	CVE-2019-20479No exploit	A flaw was found in mod_auth_openidc before version 2.4.1.openidc · mod auth openidc · CWE-601 Pre-auth Open redirect	Medium6.1	—	1.8%	Feb 20, 2020
25Monitor	CVE-2021-39191No exploit	URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidcopenidc · mod auth openidc · CWE-601 Pre-auth Open redirect	Medium6.1	—	1.7%	Sep 3, 2021
24Monitor	CVE-2019-14857No exploit	A flaw was found in mod_auth_openidc before version 2.4.0.1.openidc · mod auth openidc · CWE-601 Pre-auth Open redirect	Medium6.1	—	1.5%	Nov 26, 2019
24Monitor	CVE-2021-32792No exploit	XSS vulnerability when using OIDCPreservePost On in mod_auth_openidcopenidc · mod auth openidc · CWE-79 Pre-auth XSS	Medium6.1	—	1.5%	Jul 26, 2021
24Monitor	CVE-2019-1010247No exploit	ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS).openidc · mod auth openidc · CWE-79 Pre-auth XSS	Medium6.1	—	1.2%	Jul 19, 2019
24Monitor	CVE-2022-23527No exploit	Open Redirect in oidc_validate_redirect_url()openidc · mod auth openidc · CWE-601 Pre-auth Open redirect	Medium6.1	—	0.9%	Dec 14, 2022
23Monitor	CVE-2021-32791No exploit	Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidcopenidc · mod auth openidc · CWE-323 Pre-auth	Medium5.9	—	1.5%	Jul 26, 2021

CVE-2017-6413
35Monitor
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.6 for the Apache HTTP Server does
HighCVSS 8.6No exploitEPSS 4%
- Pre-auth
- Auth bypass
openidc · mod auth openidcMar 2, 2017
CVE-2017-6062
35Monitor
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does
HighCVSS 8.6No exploitEPSS 3%
- Pre-auth
- Auth bypass
openidc · mod auth openidcMar 2, 2017
CVE-2017-6059
32Monitor
Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote att
HighCVSS 7.5No exploitEPSS 5%
- Pre-auth
openidc · mod auth openidcApr 12, 2017
CVE-2021-20718
31Monitor
mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.
HighCVSS 7.5No exploitEPSS 3%
- Pre-auth
- Denial of service
openidc · mod auth openidcMay 19, 2021
CVE-2021-32785
31Monitor
Format string bug in the Redis cache implementation
HighCVSS 7.5No exploitEPSS 2%
- pre-auth RCE
- Denial of service
openidc · mod auth openidcJul 22, 2021
CVE-2023-28625
30Monitor
mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied
HighCVSS 7.5No exploitEPSS 1%
openidc · mod auth openidcApr 3, 2023
CVE-2024-24814
30Monitor
Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
openidc · mod auth openidcFeb 13, 2024
CVE-2021-32786
25Monitor
Open Redirect in oidc_validate_redirect_url()
MediumCVSS 6.1No exploitEPSS 2%
- Pre-auth
- Open redirect
openidc · mod auth openidcJul 22, 2021
CVE-2019-20479
25Monitor
A flaw was found in mod_auth_openidc before version 2.4.1.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- Open redirect
openidc · mod auth openidcFeb 20, 2020
CVE-2021-39191
25Monitor
URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- Open redirect
openidc · mod auth openidcSep 3, 2021
CVE-2019-14857
24Monitor
A flaw was found in mod_auth_openidc before version 2.4.0.1.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- Open redirect
openidc · mod auth openidcNov 26, 2019
CVE-2021-32792
24Monitor
XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
openidc · mod auth openidcJul 26, 2021
CVE-2019-1010247
24Monitor
ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS).
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
openidc · mod auth openidcJul 19, 2019
CVE-2022-23527
24Monitor
Open Redirect in oidc_validate_redirect_url()
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- Open redirect
openidc · mod auth openidcDec 14, 2022
CVE-2021-32791
23Monitor
Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc
MediumCVSS 5.9No exploitEPSS 1%
- Pre-auth
openidc · mod auth openidcJul 26, 2021