[{"CVE":"CVE-2019-13038","severity":"moderate","public_date":"2019-06-20T00:00:00Z","advisories":["RHSA-2020:1003","RHSA-2020:1660"],"bugzilla":"1725740","bugzilla_description":"CVE-2019-13038 mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-601","affected_packages":["mod_auth_mellon-0:0.14.0-8.el7","mod_auth_mellon-0:0.14.0-11.el8"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-13038.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss3_score":"5.4"},{"CVE":"CVE-2019-3877","severity":"moderate","public_date":"2019-03-22T00:00:00Z","advisories":["RHSA-2019:3421","RHSA-2019:0766"],"bugzilla":"1691125","bugzilla_description":"CVE-2019-3877 mod_auth_mellon: open redirect in logout url when using URLs with backslashes","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-601","affected_packages":["mod_auth_mellon-0:0.14.0-2.el7_6.4","mod_auth_mellon-0:0.14.0-9.el8"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3877.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","cvss3_score":"5.8"},{"CVE":"CVE-2019-3878","severity":"important","public_date":"2018-05-10T00:00:00Z","advisories":["RHSA-2019:0746","RHSA-2019:0985","RHSA-2019:0766"],"bugzilla":"1691126","bugzilla_description":"CVE-2019-3878 mod_auth_mellon: authentication bypass in ECP flow","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-305","affected_packages":["httpd24-mod_auth_mellon-0:0.13.1-2.el7.1","mod_auth_mellon-0:0.14.0-2.el7_6.4","mod_auth_mellon-0:0.14.0-3.el8_0.2"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3878.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss3_score":"8.1"},{"CVE":"CVE-2017-6807","severity":"moderate","public_date":"2017-03-13T00:00:00Z","advisories":[],"bugzilla":"1431670","bugzilla_description":"CVE-2017-6807 mod_auth_mellon: Cross-site session transfer vulnerability","cvss_score":null,"cvss_scoring_vector":null,"CWE":null,"affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-6807.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss3_score":"6.4"},{"CVE":"CVE-2016-2145","severity":"moderate","public_date":"2016-03-09T00:00:00Z","advisories":[],"bugzilla":"1315739","bugzilla_description":"CVE-2016-2145 mod_auth_mellon: Missing error check when calling ap_get_client_block()","cvss_score":4.3,"cvss_scoring_vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","CWE":"CWE-391","affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2145.json"},{"CVE":"CVE-2016-2146","severity":"moderate","public_date":"2016-03-09T00:00:00Z","advisories":[],"bugzilla":"1315747","bugzilla_description":"CVE-2016-2146 mod_auth_mellon: Failure to limit amount of POST data submitted by client","cvss_score":4.3,"cvss_scoring_vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","CWE":"CWE-20","affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2146.json"},{"CVE":"CVE-2014-8566","severity":"important","public_date":"2014-11-03T00:00:00Z","advisories":["RHSA-2014:1803"],"bugzilla":"1157281","bugzilla_description":"CVE-2014-8566 mod_auth_mellon: remote memory disclosure flaw","cvss_score":5.0,"cvss_scoring_vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","CWE":"CWE-200","affected_packages":["mod_auth_mellon-0:0.8.0-3.el6_6"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-8566.json"},{"CVE":"CVE-2014-8567","severity":"moderate","public_date":"2014-11-03T00:00:00Z","advisories":["RHSA-2014:1803"],"bugzilla":"1157954","bugzilla_description":"CVE-2014-8567 mod_auth_mellon: logout processing leads to denial of service","cvss_score":4.0,"cvss_scoring_vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","CWE":null,"affected_packages":["mod_auth_mellon-0:0.8.0-3.el6_6"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-8567.json"}]