Description (CNA)
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / JBoss Core Services for RHEL 8 | unaffected 0:1.3.20-3.el8jbcs before * |
| Red Hat / JBoss Core Services on RHEL 7 | unaffected 0:1.3.20-3.el7jbcs before * |
| Red Hat / Red Hat Enterprise Linux 9 | unaffected 0:1.3.20-1.el9_4 before * |
CWE
CWE-79
References
- https://access.redhat.com/errata/RHSA-2024:1316
- https://access.redhat.com/errata/RHSA-2024:1317
- https://access.redhat.com/errata/RHSA-2024:2387
- https://access.redhat.com/security/cve/CVE-2023-6710
- https://bugzilla.redhat.com/show_bug.cgi?id=2254128
ADP enrichment
No English description supplied.