A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2024:1316 | |
| https://access.redhat.com/errata/RHSA-2024:1317 | |
| https://access.redhat.com/errata/RHSA-2024:2387 | |
| https://access.redhat.com/security/cve/CVE-2023-6710 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2254128 | Issue Tracking Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
30 Apr 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Mar 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Jan 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page. |
18 Dec 2023, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-12 22:15
Updated : 2024-04-30 15:15
NVD link : CVE-2023-6710
Mitre link : CVE-2023-6710
CVE.ORG link : CVE-2023-6710
JSON object : View
Products Affected
redhat
- enterprise_linux
modcluster
- mod_proxy_cluster
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')