Log in Start free

Vulnerability · Published Dec 12, 2023 · Assigned by redhat

CVE-2023-6710Mod_cluster/mod_proxy_cluster: stored cross site scripting

Medium 5.4

In plain English

A medium-severity cross-site scripting in JBoss Core Services for RHEL 8 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)2.2%top 17.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9mod_jk1.2.49-1.el9_4ALSA-2024:2387
AlmaLinux:9mod_proxy_cluster1.3.20-1.el9_4ALSA-2024:2387

Affected products (as reported)

VendorProductVersions
Red Hat JBoss Core Services for RHEL 8 see references
Red Hat JBoss Core Services on RHEL 7 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References