CVE-2019-10092

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

CVSS v3.1

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

81.47% chance of exploitation in the next 30 days, 100th percentile

Nuclei

medium · CWE-79

Published

2019-09-26

Updated

2024-08-04

Proof-of-concept exploits (3)

• DrunkenShells/Disclosures/tree/master/CVE-2019-10092-Limited%20Cross-Site%20Scripting%20i…
• mbadanoiu/CVE-2019-100920★ · 2024-06-09
• motikan2010/CVE-2019-10092_Docker5★ · 2020-01-07

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-10092.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/47688

References

• CVE Record
• NVD entry

Related

• CVE-2019-11287
• CVE-2019-12401
• CVE-2019-12409
• CVE-2019-1332
• CVE-2019-14678
• CVE-2019-7656