CVE-2019-10098CWE-601

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…

published September 25, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.

CVSS
—
EPSS
74%
Percentile
99.5
In the wild
Unconfirmed
What it is

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.73981 · 99.5th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2019-09-25T16:39Z
EPSS history
Timeline
  • 25 SEP 16:39Z
    In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…
    cvelistv5