CVE-2017-6807: Uninett Mod Auth Mellon

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.

Affected products

• Uninett Mod Auth Mellon: up to and including 0.13.0

Published 2017-03-13. Last modified 2026-06-17.