CVE-2019-10092

A cross-site scripting vulnerability was found in Apache httpd, affecting the mod_proxy error page. Under certain circumstances, a crafted link could inject content into the HTML displayed in the error page, potentially leading to client-side exploitation.

Mitigation

This flaw is only exploitable if Proxy* directives are used in Apache httpd configuration. The following command can be used to search for possible vulnerable configurations:

grep -R '^\s*Proxy' /etc/httpd/  

See <https://httpd.apache.org/docs/2.4/mod/mod_proxy.html&gt;