medium5.4Public exploit code
CVE-2023-6710
A flaw was found in the mod_proxy_cluster in the Apache server.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache mod_proxy_cluster 1.2.6 - Stored XSS2024-05-13 · webapps · php
Impact
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Modcluster | Mod Proxy Cluster | All versions |
| Redhat | Enterprise Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/errata/RHSA-2024:1316
- https://access.redhat.com/errata/RHSA-2024:1317
- https://access.redhat.com/errata/RHSA-2024:2387
- https://access.redhat.com/security/cve/CVE-2023-6710
- https://bugzilla.redhat.com/show_bug.cgi?id=2254128
- https://access.redhat.com/errata/RHSA-2024:1316
- https://access.redhat.com/errata/RHSA-2024:1317
- https://access.redhat.com/errata/RHSA-2024:2387
- https://access.redhat.com/security/cve/CVE-2023-6710
- https://bugzilla.redhat.com/show_bug.cgi?id=2254128