CVE-2017-6807 mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site....
MediumCVSS 6.1
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libapache2-mod-auth-mellon(Debian:12) | < 0.12.0-2 | 0.12.0-2 |
| debian/libapache2-mod-auth-mellon(Debian:13) | < 0.12.0-2 | 0.12.0-2 |
| debian/libapache2-mod-auth-mellon(Debian:14) | < 0.12.0-2 | 0.12.0-2 |
| uninett mod auth mellon | <= 0.13.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-6807 vendor-advisory
- 96843 vdb-entry
- github.com issue-tracking patch third-party-advisory
- sympa.uninett.no not-applicable