CVE-2023-6710

Description

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

Reserved 2023-12-12 | Published 2023-12-12 | Updated 2024-11-24 | Assigner redhat

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Default status
affected

0:1.3.20-3.el8jbcs before *
unaffected

Default status
affected

0:1.3.20-3.el7jbcs before *
unaffected

Default status
affected

0:1.3.20-1.el9_4 before *
unaffected

Default status
unaffected

Default status
affected

Timeline

2023-12-12:	Reported to Red Hat.
2023-12-12:	Made public.

Credits

Red Hat would like to thank Mohamed Mounir Boudjema (Intervalle-Technologies) for reporting this issue.

References

access.redhat.com/errata/RHSA-2024:1316 (RHSA-2024:1316) vendor-advisory

access.redhat.com/errata/RHSA-2024:1317 (RHSA-2024:1317) vendor-advisory

access.redhat.com/errata/RHSA-2024:2387 (RHSA-2024:2387) vendor-advisory

access.redhat.com/security/cve/CVE-2023-6710 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2254128 (RHBZ#2254128) issue-tracking

cve.org (CVE-2023-6710)

nvd.nist.gov (CVE-2023-6710)

Download JSON