Cross-site scripting in Apache HTTP Server - CVE-2019-10092

Vulnerability identifier: #VU20384

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

CVE-ID: CVE-2019-10092

CWE-ID: CWE-79

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data on the mod_proxy error page. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Apache HTTP Server
JBoss Core Services
Amazon Linux AMI
Gentoo Linux
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE CaaS Platform
SUSE Manager Server
SUSE Enterprise Storage
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
Slackware Linux
SUSE Linux Enterprise Server for SAP
Opensuse
SUSE Linux Enterprise High Performance Computing
openEuler
Fedora
Red Hat Software Collections
jbcs-httpd24-brotli (Red Hat package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
apache2 (Ubuntu package)
apache2 (Debian package)
jbcs-httpd24-httpd (Red Hat package)
apache2 (Alpine package)
mod_md
apache2-debuginfo
apache2-debugsource
apache2-devel
apache2
apache2-example-pages
apache2-prefork
apache2-prefork-debuginfo
apache2-utils
apache2-utils-debuginfo
apache2-worker
apache2-worker-debuginfo
apache2-doc
httpd-filesystem
httpd-devel
httpd-debugsource
httpd-debuginfo
httpd
httpd-help
httpd-tools
mod_ldap
mod_proxy_html
mod_session
mod_ssl
IBM API Connect
Dell Secure Connect Gateway
Oracle Secure Global Desktop

Install updates from vendor's website.

Apache HTTP Server - update to 2.4.41
jbcs-httpd24-brotli (Red Hat package) - addressed in versions 1.0.6-21.jbcs.el6, 1.0.6-21.jbcs.el7
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.6.3-86.jbcs.el6, 1.6.3-86.jbcs.el7
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.11.3-22.jbcs.el6, 1.11.3-22.jbcs.el7
apache2 (Ubuntu package) - addressed in versions 2.4.18-2ubuntu3.12, 2.4.18-2ubuntu3.13, 2.4.29-1ubuntu4.10, 2.4.29-1ubuntu4.11, 2.4.38-2ubuntu2.2, 2.4.38-2ubuntu2.3
apache2 (Debian package) - update to 2.4.25-3+deb9u8
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.37-52.jbcs.el6, 2.4.37-52.jbcs.el7
apache2 (Alpine package) - update to 2.4.41-r0
IBM API Connect - update to 5.0.8.12
Dell Secure Connect Gateway - update to 5.12.00.10
mod_md - addressed in versions 2.0.8-2.fc30, 2.0.8-3.fc29
apache2-debuginfo - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2-debugsource - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2-devel - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2 - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2-example-pages - update to 2.4.23-29.69.1
apache2-prefork - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2-prefork-debuginfo - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2-utils - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2-utils-debuginfo - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2-worker - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2-worker-debuginfo - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
apache2-doc - addressed in versions 2.4.23-29.69.1, 2.4.33-3.50.1
httpd-filesystem - update to 2.4.34-18
httpd-devel - update to 2.4.34-18
httpd-debugsource - update to 2.4.34-18
httpd-debuginfo - update to 2.4.34-18
httpd - update to 2.4.34-18
httpd-help - update to 2.4.34-18
httpd-tools - update to 2.4.34-18
mod_ldap - update to 2.4.34-18
mod_md - update to 2.4.34-18
mod_proxy_html - update to 2.4.34-18
mod_session - update to 2.4.34-18
mod_ssl - update to 2.4.34-18
httpd - addressed in versions 2.4.41-1.fc29, 2.4.41-1.fc30

• https://httpd.apache.org/security/vulnerabilities_24.html

• Multiple vulnerabilities in Apache HTTP Server
• Debian update for apache2
• Ubuntu update for Apache HTTP Server
• OpenSUSE Linux update for apache2
• Gentoo update for Apache
• Ubuntu regression update for Apache HTTP Server
• Amazon Linux AMI update for httpd24
• Red Hat Software Collections update for httpd24-httpd
• Slackware Linux update for httpd
• Red Hat JBoss Core Services update for Apache HTTP Server
• Multiple vulnerabilities in Oracle Secure Global Desktop
• Cross-site scripting in apache2 (Alpine package)
• Red Hat Enterprise Linux 8 update for the httpd:2.4 module
• SUSE update for apache2
• Multiple vulnerabilities in DELL Secure Connect Gateway Security
• Multiple vulnerabilities in IBM API Connect
• SUSE update for apache2
• openEuler 20.03 LTS update for httpd
• Fedora 30 update for httpd, mod_md
• Fedora 29 update for httpd, mod_md