CVE-2019-13038 Open redirect in n/a

Medium 6.1 Published 29 Jun 2019 Updated 4 Aug 2024

An attacker can redirect users to malicious sites via the ReturnTo parameter in mod_auth_mellon, potentially facilitating phishing attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2019-13038?

CVE-2019-13038 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 29 Jun 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.

Weakness: CWE-601

Which versions are affected by CVE-2019-13038?

It affects 4 products.

Linux distribution packages (11)

`mod_auth_mellon` Red Hat:enterprise_linux:7::server	All versions	`0:0.14.0-8.el7`
`mod_auth_mellon-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:0.14.0-8.el7`
`mod_auth_mellon-diagnostics` Red Hat:enterprise_linux:7::server	All versions	`0:0.14.0-8.el7`
`mod_auth_mellon` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.14.0-8.el7`
`mod_auth_mellon-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.14.0-8.el7`
`mod_auth_mellon-diagnostics` Red Hat:enterprise_linux:7::workstation	All versions	`0:0.14.0-8.el7`
`mod_auth_mellon` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-11.el8`
`mod_auth_mellon-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-11.el8`
`mod_auth_mellon-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-11.el8`
`mod_auth_mellon-diagnostics` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-11.el8`
`mod_auth_mellon-diagnostics-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-11.el8`

Products include Canonical Ubuntu Linux, Fedoraproject Fedora, Mod Auth Mellon Project Mod Auth Mellon, Oracle Zfs Storage Appliance Kit.

How do I fix CVE-2019-13038?

Apply the vendor's patch.

Is CVE-2019-13038 being exploited?

There is no known exploitation of CVE-2019-13038 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-13038, GHSA-67h8-fxm4-vr72, RHSA-2020:1003, RHSA-2020:1660, UBUNTU-CVE-2019-13038, USN-4291-1.