Bug 2254128 (CVE-2023-6710)

Summary: CVE-2023-6710 mod_cluster/mod_proxy_cluster: Stored Cross site Scripting
Product: [Other] Security Response Reporter: Avinash Hanwate <ahanwate>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: csutherl, jclere, pdelbell, pjindal, plodge, szappis
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2254134, 2266607    

Description Avinash Hanwate 2023-12-12 05:51:25 UTC 
A flaw was found in the mod_proxy_cluster in the Apache server. A malicious user can add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting vulnerability.  by adding a script on the alias parameter on the URL it adds a new virtual host and adds the script to the cluster-manager page. The impact of this vulnerability is considered as Low as the cluster_manager URL should NOT be exposed outside and protected by user/password.
Comment 2 errata-xmlrpc 2024-03-18 16:22:27 UTC 
This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2024:1317 https://access.redhat.com/errata/RHSA-2024:1317
Comment 3 errata-xmlrpc 2024-03-18 16:34:04 UTC 
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2024:1316 https://access.redhat.com/errata/RHSA-2024:1316
Comment 4 errata-xmlrpc 2024-04-30 10:07:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2387 https://access.redhat.com/errata/RHSA-2024:2387
Comment 5 Guilherme de Almeida Suckevicz 2024-08-29 20:18:45 UTC 
*** Bug 2266608 has been marked as a duplicate of this bug. ***