CVE-2017-6807

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/96843
https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1Issue Tracking, Patch, Third Party Advisory
https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.htmlNot Applicable
http://www.securityfocus.com/bid/96843
https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1Issue Tracking, Patch, Third Party Advisory
https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.htmlNot Applicable

Timeline

Published: Mar 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-68086.1paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.faq.php (id parameter).CVE-2017-68096.1paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.donate.php (id parameter).CVE-2017-68106.1paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.fplinks.php (linkid parameter).CVE-2017-68116.1paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.shop.php (id parameter).CVE-2017-68126.1paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.vote.php (id parameter).CVE-2017-68139.8A service provided by Zimbra Collaboration Suite (ZCS) before 8.7.6 fails to require needed privileges before performing a few requested ope CVE-2017-68145.4In WordPress before 4.7.3, there is authenticated Cross-Site Scripting (XSS) via Media File Metadata. This is demonstrated by both (1) misha CVE-2017-68156.1In WordPress before 4.7.3 (wp-includes/pluggable.php), control characters can trick redirect URL validation.CVE-2017-68164.9In WordPress before 4.7.3 (wp-admin/plugins.php), unintended files can be deleted by administrators using the plugin deletion functionality.CVE-2017-68175.4In WordPress before 4.7.3 (wp-includes/embed.php), there is authenticated Cross-Site Scripting (XSS) in YouTube URL Embeds.CVE-2017-68186.1In WordPress before 4.7.3 (wp-admin/js/tags-box.js), there is cross-site scripting (XSS) via taxonomy term names.CVE-2017-68196.5In WordPress before 4.7.3, there is cross-site request forgery (CSRF) in Press This (wp-admin/includes/class-wp-press-this.php), leading to