CVE-2019-10092

MEDIUM
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

References

https://httpd.apache.org/security/vulnerabilities_24.html

https://lists.debian.org/debian-lts-announce/2019/09/msg00034.html

https://seclists.org/bugtraq/2019/Oct/24

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

https://access.redhat.com/errata/RHSA-2019:4126

https://www.oracle.com/security-alerts/cpujan2020.html

https://lists.apache.org/thread.html/[email protected]%3Cusers.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://www.debian.org/security/2019/dsa-4509

https://security.netapp.com/advisory/ntap-20190905-0003/

https://seclists.org/bugtraq/2019/Aug/47

http://www.openwall.com/lists/oss-security/2019/08/15/4

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html

https://security.gentoo.org/glsa/201909-04

https://lists.fedoraproject.org/archives/list/[email protected]/message/7RVHJHTU4JN3ULCQ44F2G6LZBF2LGNTC/

https://lists.apache.org/thread.html/[email protected]%3Cannounce.httpd.apache.org%3E

https://usn.ubuntu.com/4113-1/

https://lists.debian.org/debian-lts-announce/2019/08/msg00034.html

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-10092-Limited%20Cross-Site%20Scripting%20in%20mod_proxy%20Error%20Page-Apache%20httpd

https://support.f5.com/csp/article/K30442259

http://www.openwall.com/lists/oss-security/2020/08/08/1

http://www.openwall.com/lists/oss-security/2020/08/08/9

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

Details

Source: MITRE

Published: 2019-09-26

Updated: 2021-06-06

Type: CWE-79

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Impact Score: 2.7

Exploitability Score: 2.8

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* versions from 2.4.0 to 2.4.39 (inclusive)

Configuration 2

OR

cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 4

OR

cpe:2.3:a:redhat:software_collection:1.0:*:*:*:*:*:*:*

Configuration 5

OR

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

Configuration 6

OR

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*

Configuration 7

OR

cpe:2.3:o:netapp:clustered_data_ontap:*:*:*:*:*:*:*:* versions up to 9.5 (inclusive)

cpe:2.3:o:netapp:clustered_data_ontap:9.6:-:*:*:*:*:*:*

cpe:2.3:o:netapp:clustered_data_ontap:9.6:p1:*:*:*:*:*:*

cpe:2.3:o:netapp:clustered_data_ontap:9.6:p3:*:*:*:*:*:*

cpe:2.3:o:netapp:clustered_data_ontap:9.6:p4:*:*:*:*:*:*

cpe:2.3:o:netapp:clustered_data_ontap:9.6:p7:*:*:*:*:*:*

cpe:2.3:o:netapp:clustered_data_ontap:9.6:p8:*:*:*:*:*:*

Configuration 8

OR

cpe:2.3:a:oracle:communications_element_manage:8.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_element_manage:8.1.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_element_manage:8.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:communications_element_manage:8.2.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:secure_global_desktop:5.5:*:*:*:*:*:*:*

Tenable Plugins

View all (32 total)

IDNameProductFamilySeverity
147785SUSE SLES12 Security Update : apache2 (SUSE-SU-2021:0779-1)NessusSuSE Local Security Checks
medium
145821CentOS 8 : httpd:2.4 (CESA-2020:4751)NessusCentOS Local Security Checks
critical
144775IBM HTTP Server 7.0.0.0 <= 7.0.0.45 / 8.0.0.0 <= 8.0.0.15 / 8.5.0.0 < 8.5.5.17 / 9.0.0.0 < 9.0.5.1 Multiple Vulnerabilities (964768)NessusWeb Servers
medium
142762Oracle Linux 8 : httpd:2.4 (ELSA-2020-4751)NessusOracle Linux Local Security Checks
critical
142397RHEL 8 : httpd:2.4 (RHSA-2020:4751)NessusRed Hat Local Security Checks
critical
140870EulerOS 2.0 SP3 : httpd (EulerOS-SA-2020-2103)NessusHuawei Local Security Checks
medium
137492EulerOS 2.0 SP2 : httpd (EulerOS-SA-2020-1650)NessusHuawei Local Security Checks
medium
136255EulerOS Virtualization for ARM 64 3.0.2.0 : httpd (EulerOS-SA-2020-1552)NessusHuawei Local Security Checks
medium
135617EulerOS Virtualization 3.0.2.2 : httpd (EulerOS-SA-2020-1455)NessusHuawei Local Security Checks
medium
135235RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 (RHSA-2020:1337)NessusRed Hat Local Security Checks
critical
135160Slackware 14.0 / 14.1 / 14.2 / current : httpd (SSA:2020-091-02) (Internal Data Buffering)NessusSlackware Local Security Checks
critical
135157EulerOS Virtualization for ARM 64 3.0.6.0 : httpd (EulerOS-SA-2020-1370)NessusHuawei Local Security Checks
medium
134781EulerOS 2.0 SP8 : httpd (EulerOS-SA-2020-1289)NessusHuawei Local Security Checks
medium
133042Oracle Secure Global Desktop Multiple Vulnerabilities (January 2020 CPU)NessusMisc.
medium
132358EulerOS 2.0 SP5 : httpd (EulerOS-SA-2019-2691)NessusHuawei Local Security Checks
medium
130400Amazon Linux 2 : httpd (ALAS-2019-1341)NessusAmazon Linux Local Security Checks
high
130281Amazon Linux AMI : httpd24 (ALAS-2019-1311) (Internal Data Buffering)NessusAmazon Linux Local Security Checks
critical
130109Photon OS 1.0: Httpd PHSA-2019-1.0-0253NessusPhotonOS Local Security Checks
critical
130101Photon OS 3.0: Httpd PHSA-2019-3.0-0035NessusPhotonOS Local Security Checks
critical
129688Photon OS 2.0: Httpd PHSA-2019-2.0-0178NessusPhotonOS Local Security Checks
critical
128993Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : Apache HTTP Server regression (USN-4113-2) (Internal Data Buffering)NessusUbuntu Local Security Checks
critical
128612SUSE SLES12 Security Update : apache2 (SUSE-SU-2019:2329-1) (Internal Data Buffering)NessusSuSE Local Security Checks
critical
128593GLSA-201909-04 : Apache: Multiple vulnerabilities (Internal Data Buffering)NessusGentoo Local Security Checks
critical
128460openSUSE Security Update : apache2 (openSUSE-2019-2051) (Internal Data Buffering)NessusSuSE Local Security Checks
critical
128412Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : Apache HTTP Server vulnerabilities (USN-4113-1) (Internal Data Buffering)NessusUbuntu Local Security Checks
critical
128316SUSE SLED15 / SLES15 Security Update : apache2 (SUSE-SU-2019:2237-1) (Internal Data Buffering)NessusSuSE Local Security Checks
critical
128306Debian DLA-1900-2 : apache2 regression updateNessusDebian Local Security Checks
medium
128182Debian DSA-4509-1 : apache2 - security update (Internal Data Buffering)NessusDebian Local Security Checks
critical
128084Fedora 30 : 1:mod_md / httpd (2019-099575a123)NessusFedora Local Security Checks
high
98669Apache 2.4.x < 2.4.41 Multiple VulnerabilitiesWeb Application ScanningComponent Vulnerability
critical
128033Apache 2.4.x < 2.4.41 Multiple VulnerabilitiesNessusWeb Servers
critical
127951FreeBSD : Apache -- Multiple vulnerabilities (caf545f2-c0d9-11e9-9051-4c72b94353b5) (Internal Data Buffering)NessusFreeBSD Local Security Checks
critical