CVE-2023-6710

MediumCVSS 5.4

Published: 12/12/2023(UTC)Updated: 19/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.24%

82th percentile - higher than 82% of all known CVEs

Summary

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

Risk Assessment

Stored XSS can lead to administrator session theft, account takeover, or actions performed on behalf of a logged-in user on the cluster-manager page.

Recommendation

Update mod_proxy_cluster to a version containing the fix and verify and remove unauthorized virtual host entries and scripts on the cluster-manager page.

Other vulnerabilities in mod_proxy_cluster

CVE-2024-10306Medium
A vulnerability was found in mod_proxy_cluster where the <Directory> directive is incorrectly used instead of <Location>. The <Directory> directive does not restrict access based on IP address, allowing anyone with host access to send MCMP requests that can add, remove, or update load-balancing nodes.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS