Cross-Site Scripting Vulnerability in Apache HTTP Server - CVE-2019-10092
Summary
UBUNTU-CVE-2019-10092: In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. Affects apache2 versions 2.4.6-2ubuntu2 – 2.4.7-1ubuntu4.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, power, and extensive feature set, including support for various modules and configurations. However, a vulnerability identified as CVE-2019-10092 has been discovered, affecting specific versions of the Apache2 package, which could lead to security risks if not addressed.
Vulnerability Detail
CVE-2019-10092 is a limited cross-site scripting (XSS) vulnerability found in Apache HTTP Server versions 2.4.0 to 2.4.39. The issue arises from the mod_proxy error page, where an attacker can manipulate the link on the error page to redirect users to a malicious site. This vulnerability is particularly exploitable when a server is misconfigured to display the Proxy Error page, allowing attackers to potentially mislead users and compromise their security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, consider disabling the proxy feature in your Apache configuration to mitigate the risk of exploitation. This can be done by commenting out or removing the relevant Proxy directives in your Apache configuration files.
Conclusion
CVE-2019-10092 represents a significant security risk for users of Apache HTTP Server versions 2.4.0 to 2.4.39. It is crucial to update to a patched version to protect against potential exploitation. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for apache2 →
FAQ
CVE-2019-10092 is a cross-site scripting vulnerability in Apache HTTP Server that allows attackers to manipulate error page links.
The vulnerability affects Apache HTTP Server versions 2.4.0 to 2.4.39.
You can use Vulert, which monitors open-source vulnerabilities in software. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2019-10092 is 6.1, indicating a medium severity level.
If you cannot update, disable the proxy feature in your Apache configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
