CVE-2019-10092
MEDIUM 6.1EPSS 81.5%
In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.
- Affected
- Apache HTTP Server
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 81.47% chance of exploitation in the next 30 days, 100th percentile
- Nuclei
- medium · CWE-79
- Published
- 2019-09-26
- Updated
- 2024-08-04
Proof-of-concept exploits (3)
- DrunkenShells/Disclosures/tree/master/CVE-2019-10092-Limited%20Cross-Site%20Scripting%20i…92★ · 2022-02-13
- mbadanoiu/CVE-2019-100920★ · 2024-06-09
- motikan2010/CVE-2019-10092_Docker4★ · 2020-01-07
Nuclei templates (1)
ExploitDB entries (1)
Security advisories
- https://httpd.apache.org/security/vulnerabilities_24.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html
- http://www.openwall.com/lists/oss-security/2019/08/15/4
- https://access.redhat.com/errata/RHSA-2019:4126
- https://lists.debian.org/debian-lts-announce/2019/08/msg00034.html
- https://lists.debian.org/debian-lts-announce/2019/09/msg00034.html
- https://seclists.org/bugtraq/2019/Aug/47
- https://seclists.org/bugtraq/2019/Oct/24
- https://security.gentoo.org/glsa/201909-04
- https://security.netapp.com/advisory/ntap-20190905-0003
- https://support.f5.com/csp/article/K30442259
- https://usn.ubuntu.com/4113-1
- https://www.debian.org/security/2019/dsa-4509
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html