CVE-2023-6710

2023-12-1206:27:11

redhat.com

access.redhat.com

apache server

cross-site scripting

mod_proxy_cluster

url

vulnerability

virtual host

cluster-manager page

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

30.2%

JSON

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the ‘alias’ parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

Mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.