CVE-2024-10306
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability was found in mod_proxy_cluster where the <Directory> directive is incorrectly used instead of <Location>. The <Directory> directive does not restrict access based on IP address, allowing anyone with host access to send MCMP requests that can add, remove, or update load-balancing nodes.
Risk Assessment
The risk is unauthorized modification of cluster configuration by users with host access, potentially compromising the integrity and availability of load-balancing services.
Recommendation
Replace the <Directory> directive with the <Location> directive in the mod_proxy_cluster configuration to properly restrict access based on IP address. Additionally, ensure the host is not accessible from the public network.
Original NVD description (English source)
A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.