Bug 919880 (CVE-2023-6710)

Summary:	www-servers/apache: XSS in mod_proxy_cluster
Product:	Gentoo Security	Reporter:	Christopher Fore <csfore>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED INVALID
Severity:	minor	CC:	apache-bugs
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B4 [upstream]
Package list:		Runtime testing required:	---

Description Christopher Fore 2023-12-14 14:26:57 UTC

CVE-2023-6710 (https://access.redhat.com/security/cve/CVE-2023-6710):

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page. The impact of this vulnerability is considered as Low, as the cluster_manager URL should not be exposed outside and is protected by user/password.


No published info from upstream, just a CVE from RedHat.

Comment 1 Hans de Graaff gentoo-dev

2023-12-23 07:42:02 UTC

mod_proxy_cluster is a separate module that is distributed independent of the Apache httpd server and not packaged in Gentoo.

https://github.com/modcluster/mod_proxy_cluster