Podatność CVE-2023-6710

Podatność CVE-2023-6710

Publikacja: 2023-12-12 Modyfikacja: 2023-12-14

Opis:

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page. The impact of this vulnerability is considered as Low, as the cluster_manager URL should not be exposed outside and is protected by user/password.

W naszej bazie, znaleźliśmy następujące noty dla tego CVE:

	Tytuł	Autor	Data
Low	Apache mod_proxy_cluster Cross Site Scripting	Mohamed Mounir B...	14.05.2024
Med.	Apache mod_proxy_cluster Stored XSS	Anonymous	16.07.2024

Typ:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

Referencje:

https://access.redhat.com/security/cve/CVE-2023-6710

https://bugzilla.redhat.com/show_bug.cgi?id=2254128

Copyright 2024, cxsecurity.com