CVE-2023-6710

MEDIUM

Mod_cluster/mod_proxy_cluster: stored cross site scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-6710 has a selected CVSS score of 5.4 (medium); EIP currently links 1 catalogued exploit and 2 repository PoCs.

Description

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
2

Affected products and versions

5
ProductSourceVersion range

JBoss Core Services for RHEL 8

Browse Red Hat / JBoss Core Services for RHEL 8jbcs-httpd24-mod_proxy_cluster

Default status: affected

CVE List0:1.3.20-3.el8jbcs to < *unaffected

JBoss Core Services on RHEL 7

Browse Red Hat / JBoss Core Services on RHEL 7jbcs-httpd24-mod_proxy_cluster

Default status: affected

CVE List0:1.3.20-3.el7jbcs to < *unaffected

Red Hat Enterprise Linux 9

Browse Red Hat / Red Hat Enterprise Linux 9mod_proxy_cluster

Default status: affected

CVE List0:1.3.20-1.el9_4 to < *unaffected

Red Hat JBoss Core Services

Browse Red Hat / Red Hat JBoss Core Servicesmod_proxy_cluster

Default status: affected

CVE ListVersion data not supplied

Text-Only JBCS

Browse Red Hat / Text-Only JBCSjbcs-httpd24-mod_proxy_cluster

Default status: unaffected

CVE ListVersion data not supplied

Proofs of concept

3

Catalogued exploits

ExploitDBApache mod_proxy_cluster 1.2.6 - Stored XSSExploitDB exploitby Mohamed Mounir BoudjemaNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubDedSec-47/Metasploit-Exploits-CVE-2023-6710Repository PoCby DedSec-471Not analyzed3 files

5.7 KiB

GitHub
PoC details
GitHubDedSec-47/CVE-2023-6710Repository PoCby DedSec-472Not analyzed4 files

6.5 KiB

GitHub
PoC details

References

6