The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a     mod_auth_openidc results in disclosure of protected content to unauthenticated users. The conditions for     disclosure are an OIDCProviderAuthRequestMethod POST, a valid account, and there mustn't be any     application-level gateway (or load balancer etc) protecting the server. When you request a protected     resource, the response includes the HTTP status, the HTTP headers, the intended response (the self-     submitting form), and the protected resource (with no headers). This is an example of a request for a     protected resource, including all the data returned. In the case where mod_auth_openidc returns a form, it     has to return OK from check_userid so as not to go down the error path in httpd. This means httpd will try     to issue the protected resource. oidc_content_handler is called early, which has the opportunity to     prevent the normal output being issued by httpd. oidc_content_handler has a number of checks for when it     intervenes, but it doesn't check for this case, so the handler returns DECLINED. Consequently, httpd     appends the protected content to the response. The issue has been patched in mod_auth_openidc versions >=     2.4.16.11. (CVE-2025-31492)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-80600b51c5 advisory.

    REbase mod_auth_openidc-2.4.16.11 resolves CVE-2025-31492 - mod_auth_openidc allows     OIDCProviderAuthRequestMethod POSTs to leak protected data


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2025:1337-1 advisory.

    - CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data.
    (bsc#1240893)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:3945 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data     (CVE-2025-31492)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-3997 advisory.

    cjose     mod_auth_openidc     [2.4.9.4-7]
    - Resolves: RHEL-86218 - mod_auth_openidc allows OIDCProviderAuthRequestMethod                 POSTs to leak protected data (CVE-2025-31492)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-7419 advisory.

    [2.4.10-1.el9_6.1]     Resolves: RHEL-86224 - mod_auth_openidc allows OIDCProviderAuthRequestMethod                 POSTs to leak protected data (CVE-2025-31492)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:7490 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data     (CVE-2025-31492)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
234195	Linux Distros Unpatched Vulnerability : CVE-2025-31492	Nessus	Misc.	2025/4/11	2025/10/14	high
234592	Fedora 40 : mod_auth_openidc (2025-80600b51c5)	Nessus	Fedora Local Security Checks	2025/4/17	2025/4/17	high
234614	SUSE SLES12 Security Update : apache2-mod_auth_openidc (SUSE-SU-2025:1337-1)	Nessus	SuSE Local Security Checks	2025/4/18	2025/4/18	high
234650	RHEL 9 : mod_auth_openidc (RHSA-2025:3945)	Nessus	Red Hat Local Security Checks	2025/4/21	2025/6/5	high
234722	Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2025-3997)	Nessus	Oracle Linux Local Security Checks	2025/4/22	2025/9/11	high
237152	Oracle Linux 9 : mod_auth_openidc (ELSA-2025-7419)	Nessus	Oracle Linux Local Security Checks	2025/5/22	2025/9/11	high
237822	RHEL 10 : mod_auth_openidc (RHSA-2025:7490)	Nessus	Red Hat Local Security Checks	2025/6/5	2025/6/5	high

检测

插件搜索

high

high

high

high

high

high

high