CVE-2019-10092
26.09.2019, 16:15
In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.
| Vendor | Product | Version |
|---|---|---|
| apache | http_server | 2.4.0 ≤ 𝑥 ≤ 2.4.39 |
| opensuse | leap | 15.0 |
| opensuse | leap | 15.1 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| redhat | software_collection | 1.0 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 19.04 |
| netapp | clustered_data_ontap | 𝑥 ≤ 9.5 |
| netapp | clustered_data_ontap | 9.6 |
| netapp | clustered_data_ontap | 9.6:p1 |
| netapp | clustered_data_ontap | 9.6:p3 |
| netapp | clustered_data_ontap | 9.6:p4 |
| netapp | clustered_data_ontap | 9.6:p7 |
| netapp | clustered_data_ontap | 9.6:p8 |
| oracle | communications_element_manager | 8.0.0 |
| oracle | communications_element_manager | 8.1.0 |
| oracle | communications_element_manager | 8.1.1 |
| oracle | communications_element_manager | 8.2.0 |
| oracle | enterprise_manager_ops_center | 12.3.3 |
| oracle | enterprise_manager_ops_center | 12.4.0 |
| oracle | secure_global_desktop | 5.4 |
| oracle | secure_global_desktop | 5.5 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| apache2 |
|
References