Apache2 - Limited Cross-Site Scripting and Open Redirect Vulnerabilities
Summary
DLA-1900-2: apache2 - regression update. Affects apache2 versions < 2.4.10-10+deb8u16. Fixed in 2.4.10-10+deb8u16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a widely used open-source web server software that provides a secure and efficient platform for hosting websites. It offers various modules and features to enhance web server functionality and performance. However, two security vulnerabilities have been discovered in Apache2, which could potentially compromise the security of the server and its hosted applications.
Vulnerability Detail
The first vulnerability, identified as CVE-2019-10092, is a limited cross-site scripting (XSS) vulnerability in the mod_proxy error page. This vulnerability allows an attacker to inject malicious scripts into the error page, which could be executed in the context of the victim's browser. This could lead to various attacks, such as stealing sensitive information or performing unauthorized actions on behalf of the victim.
The second vulnerability, known as CVE-2019-10098, is a potential open redirect vulnerability in the mod_rewrite module. An attacker could exploit this vulnerability to redirect users to malicious websites or phishing pages, tricking them into revealing sensitive information or performing unintended actions.
Both vulnerabilities pose a significant risk to the security and integrity of the Apache2 server and its hosted applications.
How To Fix
Minimum fixed version
2.4.10-10+deb8u16
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The discovered vulnerabilities in Apache2 pose a significant risk to the security of the server and its hosted applications. It is crucial to promptly upgrade the Apache2 package to the recommended version to mitigate these vulnerabilities and ensure the continued security of the server.
See every vulnerability recorded for apache2 →
FAQ
Apache2 is an open-source web server software widely used for hosting websites.
CVE-2019-10092 is a limited cross-site scripting (XSS) vulnerability in the mod_proxy error page of Apache2.
CVE-2019-10098 is a potential open redirect vulnerability in the mod_rewrite module of Apache2.
These vulnerabilities could allow attackers to execute malicious scripts, steal sensitive information, or redirect users to malicious websites.
To fix these vulnerabilities, you should upgrade the Apache2 package to version 2.4.10-10+deb8u16 or later.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
