Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2019-10092

Опубликовано: 26 сент. 2019
Источник: nvd
CVSS3: 6.1
CVSS2: 4.3
EPSS Высокий

Описание

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

Ссылки

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Версия от 2.4.0 (включая) до 2.4.39 (включая)
Конфигурация 2

Одно из

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Конфигурация 4
cpe:2.3:a:redhat:software_collection:1.0:*:*:*:*:*:*:*
Конфигурация 5
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Конфигурация 6

Одно из

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Конфигурация 7

Одно из

cpe:2.3:o:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
Версия до 9.5 (включая)
cpe:2.3:o:netapp:clustered_data_ontap:9.6:-:*:*:*:*:*:*
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p1:*:*:*:*:*:*
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p3:*:*:*:*:*:*
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p4:*:*:*:*:*:*
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p7:*:*:*:*:*:*
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p8:*:*:*:*:*:*
Конфигурация 8

Одно из

cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:secure_global_desktop:5.5:*:*:*:*:*:*:*

EPSS

Процентиль: 99%
0.8415
Высокий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

ubuntu логотип

CVE-2019-10092

CVSS3: 6.1
ubuntu
больше 5 лет назад

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

redhat логотип

CVE-2019-10092

CVSS3: 4.7
redhat
почти 6 лет назад

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

debian логотип

CVE-2019-10092

CVSS3: 6.1
debian
больше 5 лет назад

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting iss ...

suse-cvrf логотип

SUSE-SU-2021:0779-1

suse-cvrf
больше 4 лет назад

Security update for apache2

github логотип

GHSA-qrr6-fpf4-x3v4

github
около 3 лет назад

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

EPSS

Процентиль: 99%
0.8415
Высокий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79