Description
Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.2.22-13 | — |
| Debian 13 | apache2 | 2.2.22-13 | — |
| Debian 12 | apache2 | 2.2.22-13 | — |
| Debian 6.0 | apache2 | 2.2.16-6+squeeze11 | DSA-2637-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | httpd +3 | 2.2.15-28.el6_4 | RHSA-2013:0815 |
| RHEL 6 | mod_ssl | 1:2.2.15-28.el6_4 | RHSA-2013:0815 |
| RHEL 5 | httpd +2 | 2.2.3-78.el5_9 | RHSA-2013:0815 |
| RHEL 5 | mod_ssl | 1:2.2.3-78.el5_9 | RHSA-2013:0815 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 2 | apache-commons-daemon-eap6 | 1:1.0.15-4.redhat_1.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | apache-commons-daemon-jsvc-eap6 | 1:1.0.15-1.redhat_1.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | apache-commons-pool-eap6 +1 | 1.6-6.redhat_4.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | dom4j | 1.6.1-19.redhat_5.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | ecj3 | 1:3.7.2-6.redhat_1.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | httpd +3 | 2.2.22-23.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | mod_cluster +3 | 1.2.4-1.Final_redhat_1.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | mod_cluster-native | 1.2.4-1.Final.redhat_1.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | mod_jk +2 | 1.2.37-2.redhat_1.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | mod_ssl | 1:2.2.22-23.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | tomcat-native | 1.1.27-4.redhat_1.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | tomcat6 +9 | 6.0.37-8_patch_01.ep6.el5 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss Web Server 2 | tomcat7 +9 | 7.0.40-5_patch_01.ep6.el6 | RHSA-2013:1012, RHSA-2013:1011 |
| Red Hat JBoss EAP 6 | apache-commons-beanutils | 1.8.3-12.redhat_3.2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | apache-commons-daemon-jsvc-eap6 | 1:1.0.15-2.redhat_2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | apache-cxf | 2.6.8-8.redhat_7.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | cxf-xjc-dv +3 | 2.6.0-2.redhat_4.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | hibernate4 +4 | 4.2.0-7.SP1_redhat_1.ep6.el6 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | hornetq | 2.3.5-2.Final_redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | hornetq-native +1 | 2.3.5-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | httpd +3 | 2.2.22-25.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | infinispan +4 | 5.2.7-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | ironjacamar +9 | 1.0.19-1.Final_redhat_2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jaxbintros | 1.0.2-16.GA_redhat_6.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-aesh | 0.33.7-2.redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-as-console | 1.5.6-2.Final_redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-as-ee +56 | 7.2.1-5.Final_redhat_10.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-ejb-client | 1.0.23-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-hal | 1.5.7-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-invocation | 1.1.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-jsp-api_2.2_spec | 1.0.1-6.Final_redhat_2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-logmanager | 1.4.3-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-marshalling | 1.3.18-1.GA_redhat_1.1.ep6.el6 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-modules | 1.2.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-remote-naming | 1.0.7-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-security-negotiation | 2.2.5-2.Final_redhat_2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jboss-stdio | 1.0.2-1.GA_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossas-core +1 | 7.2.1-6.Final_redhat_10.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossas-javadocs | 7.2.1-2.Final_redhat_10.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossas-modules-eap | 7.2.1-9.Final_redhat_10.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossts | 1:4.17.7-4.Final_redhat_4.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossweb | 7.2.2-1.Final_redhat_1.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossws-cxf | 4.1.4-7.Final_redhat_7.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jbossws-spi +1 | 2.1.3-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jcip-annotations-eap6 | 1.0-4.redhat_4.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | jgroups | 1:3.2.10-1.Final_redhat_2.2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | log4j-jboss-logmanager | 1.0.2-1.Final_redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | mod_ssl | 1:2.2.22-25.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | netty | 3.6.6-2.Final_redhat_1.1.ep6.el6 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | opensaml | 2.5.1-2.redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | openws | 1.4.2-10.redhat_4.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | picketbox | 4.0.17-3.SP2_redhat_2.1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | picketlink-federation | 2.1.6.3-2.Final_redhat_2.2.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | wss4j | 1.6.10-1.redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
| Red Hat JBoss EAP 6 | xml-security | 1.5.5-1.redhat_1.ep6.el5 | RHSA-2013:1208, RHSA-2013:1207 |
Advisories 6
- RHSA-2013:1207 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:1208 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:1012 Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:1011 Red Hat Security Advisory: Red Hat JBoss Web Server 2.0.1 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2013:0815 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2637-1 apache2 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- SSRT101139 vendor-advisory
- oval:org.mitre.oval:def:18977 vdb-entry signature
- 58165 vdb-entry
- http://httpd.apache.org/security/vulnerabilities_24.html
- http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c?r1=1404653&r2=1413732&diff_format=h
- FEDORA-2013-4541 vendor-advisory
- RHSA-2013:1209 vendor-advisory
- RHSA-2013:0815 vendor-advisory
- RHSA-2013:1207 vendor-advisory
- http://httpd.apache.org/security/vulnerabilities_22.html
- DSA-2637 vendor-advisory
- APPLE-SA-2013-09-12-1 vendor-advisory
- RHSA-2013:1208 vendor-advisory
- 64758 vdb-entry
- http://support.apple.com/kb/HT5880
- http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [8/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [8/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list