A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2024:1316 | |
| https://access.redhat.com/errata/RHSA-2024:1317 | |
| https://access.redhat.com/errata/RHSA-2024:2387 | |
| https://access.redhat.com/security/cve/CVE-2023-6710 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2254128 | Issue Tracking Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2024:1316 | |
| https://access.redhat.com/errata/RHSA-2024:1317 | |
| https://access.redhat.com/errata/RHSA-2024:2387 | |
| https://access.redhat.com/security/cve/CVE-2023-6710 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2254128 | Issue Tracking Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/errata/RHSA-2024:1316 - | |
| References | () https://access.redhat.com/errata/RHSA-2024:1317 - | |
| References | () https://access.redhat.com/errata/RHSA-2024:2387 - | |
| References | () https://access.redhat.com/security/cve/CVE-2023-6710 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2254128 - Issue Tracking, Third Party Advisory |
30 Apr 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Mar 2024, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
08 Jan 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page. |
18 Dec 2023, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-12 22:15
Updated : 2024-11-21 08:44
NVD link : CVE-2023-6710
Mitre link : CVE-2023-6710
CVE.ORG link : CVE-2023-6710
JSON object : View
Products Affected
modcluster
- mod_proxy_cluster
redhat
- enterprise_linux
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')