Cross-site scripting in mod_auth_openidc - CVE-2021-32792
Published: July 26, 2021 / Updated: August 1, 2023
Vulnerability identifier: #VU55291
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2021-32792
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within the "OIDCPreservePost On". A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Affected software
mod_auth_openidc
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
Fedora
cjose
cjose-devel
mod_auth_openidc
apache2-mod_auth_openidc
apache2-mod_auth_openidc-debuginfo
apache2-mod_auth_openidc-debugsource
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
SUSE Linux Enterprise Server
SUSE Linux Enterprise Module for Server Applications
Fedora
cjose
cjose-devel
mod_auth_openidc
apache2-mod_auth_openidc
apache2-mod_auth_openidc-debuginfo
apache2-mod_auth_openidc-debugsource
How to mitigate CVE-2021-32792
Install updates from vendor's website.
mod_auth_openidc - update to 2.4.9
cjose - update to 0.6.1-2
cjose-devel - update to 0.6.1-2
mod_auth_openidc - update to 2.3.7-11
apache2-mod_auth_openidc - addressed in versions 2.3.8-3.15.1, 2.4.0-3.23.1
apache2-mod_auth_openidc-debuginfo - addressed in versions 2.3.8-3.15.1, 2.4.0-3.23.1
apache2-mod_auth_openidc-debugsource - addressed in versions 2.3.8-3.15.1, 2.4.0-3.23.1
mod_auth_openidc - addressed in versions 2.4.9-1.fc33, 2.4.9-1.fc34, 2.4.9-1.fc35, 2.4.12.3-2.fc39
cjose - update to 0.6.1-2
cjose-devel - update to 0.6.1-2
mod_auth_openidc - update to 2.3.7-11
apache2-mod_auth_openidc - addressed in versions 2.3.8-3.15.1, 2.4.0-3.23.1
apache2-mod_auth_openidc-debuginfo - addressed in versions 2.3.8-3.15.1, 2.4.0-3.23.1
apache2-mod_auth_openidc-debugsource - addressed in versions 2.3.8-3.15.1, 2.4.0-3.23.1
mod_auth_openidc - addressed in versions 2.4.9-1.fc33, 2.4.9-1.fc34, 2.4.9-1.fc35, 2.4.12.3-2.fc39
External References
Related Security Bulletins
- Multiple vulnerabilities in mod_auth_openidc
- Fedora 39 update for mod_auth_openidc
- Red Hat Enterprise Linux 8 update for the mod_auth_openidc:2.3 module
- SUSE update for apache2-mod_auth_openidc
- SUSE update for apache2-mod_auth_openidc
- Fedora 35 update for mod_auth_openidc
- Fedora 34 update for mod_auth_openidc
- Fedora 33 update for mod_auth_openidc
- Anolis OS update for mod_auth_openidc:2.3 module