CVE-2019-10098

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
apacheCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
VendorProductVersion
apachehttp_server
2.4.0 ≤
𝑥
≤ 2.4.39
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
apache2
bullseye
2.4.62-1~deb11u1
fixed
bullseye (security)
2.4.62-1~deb11u2
fixed
bookworm
2.4.62-1~deb12u1
fixed
bookworm (security)
2.4.62-1~deb12u2
fixed
sid
2.4.62-3
fixed
trixie
2.4.62-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
apache2
noble
Fixed 2.4.41-1ubuntu1
released
mantic
Fixed 2.4.41-1ubuntu1
released
lunar
Fixed 2.4.41-1ubuntu1
released
kinetic
Fixed 2.4.41-1ubuntu1
released
jammy
Fixed 2.4.41-1ubuntu1
released
impish
Fixed 2.4.41-1ubuntu1
released
hirsute
Fixed 2.4.41-1ubuntu1
released
groovy
Fixed 2.4.41-1ubuntu1
released
focal
Fixed 2.4.41-1ubuntu1
released
eoan
Fixed 2.4.41-1ubuntu1
released
disco
Fixed 2.4.38-2ubuntu2.2
released
bionic
Fixed 2.4.29-1ubuntu4.10
released
xenial
Fixed 2.4.18-2ubuntu3.12
released
trusty
needed
References