Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-10092 — Cross-site Scripting in Apache Http Server

CWE-79 — Cross-site Scripting12 documents11 sources
Severity
6.1MEDIUMNVD
EPSS
82.4%
top 0.77%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
11
Apache Http ServerNetapp Clustered Data OntapApache Software Foundation Apache Http Server+8 more
Timeline
PublishedSep 26
Latest updateMay 24

Description

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages8 packages

▶NVDapache/http_server2.4.0 — 2.4.39
▶NVDopensuse/leap15.0, 15.1+1

Also affects: Debian Linux 10.0, 8.0, 9.0, Fedora 30, Ubuntu Linux 16.04, 18.04, 19.04

Patches

Patch: usn.ubuntu.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-qrr6-fpf4-x3v4: In Apache HTTP Server 2↗2022-05-24
▶
OSV
CVE-2019-10092: In Apache HTTP Server 2↗2019-09-26
▶
CVEList
CVE-2019-10092: In Apache HTTP Server 2↗2019-09-26
▶

💥Exploits & PoCs

2
Exploit-DB
Apache Httpd mod_proxy - Error Page Cross-Site Scripting↗2019-10-14
▶
Nuclei
Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Virtualization Risk Matrix: Web Server (Apache HTTPD Server) — CVE-2019-10092↗2020-01-15
▶
Ubuntu
Apache HTTP Server vulnerabilities↗2019-08-29
▶
Red Hat
httpd: limited cross-site scripting in mod_proxy error page↗2019-08-14
▶
Debian
CVE-2019-10092: apache2 - In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was rep...↗2019
▶

💬Community

2
Bugzilla
CVE-2019-10092 httpd: limited cross-site scripting in mod_proxy error page↗2019-08-21
▶
Bugzilla
CVE-2019-10092 httpd: limited cross-site scripting in mod_proxy error page [fedora-all]↗2019-08-21
▶
CVE-2019-10092 — Cross-site Scripting in Apache | cvebase