CVEvulnerability

CVE-2019-10092

6.1 MEDIUM Published 2019-09-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

Affected configurations

• apache http server (>= 2.4.0 <= 2.4.39) • opensuse leap 15.0 • opensuse leap 15.1 • debian debian linux 8.0 • debian debian linux 9.0 • debian debian linux 10.0 • redhat software collection 1.0 • fedoraproject fedora 30 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.04 • netapp clustered data ontap (<= 9.5) • netapp clustered data ontap 9.6 • oracle communications element manager 8.0.0 • oracle communications element manager 8.1.0 • oracle communications element manager 8.1.1 • oracle communications element manager 8.2.0 • oracle enterprise manager ops center 12.3.3 • oracle enterprise manager ops center 12.4.0 • oracle secure global desktop 5.4 • oracle secure global desktop 5.5

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References