CVE-2023-6710CWE-79cross-site-scripting

CVE-2023-6710

Medium · published December 13, 2023

CVSS v3.1
5.4
EPSS
2%
Percentile
82.7
In the wild
Unconfirmed
What it is

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02242 · 82.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-12-13T03:15Z
Affected products (2)
ProductVersionsFixed in
modcluster/mod_proxy_clusterall versions—
redhat/enterprise_linuxall versions—
References (10)
https://access.redhat.com/errata/RHSA-2024:1316 · [email protected]https://access.redhat.com/errata/RHSA-2024:1317 · [email protected]https://access.redhat.com/errata/RHSA-2024:2387 · [email protected]https://access.redhat.com/security/cve/CVE-2023-6710 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2254128 · [email protected]https://access.redhat.com/errata/RHSA-2024:1316 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:1317 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2024:2387 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2023-6710 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2254128 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 12 DEC 22:01Z
    Mod_cluster/mod_proxy_cluster: stored cross site scripting
    cvelistv5