Description
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | JBoss Core Services for RHEL 8 | — | — |
| Red Hat | JBoss Core Services on RHEL 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat JBoss Core Services | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | mod_jk | 1.2.49-1.el9_4 | RHSA-2024:2387 |
| RHEL 9 | mod_proxy_cluster | 1.3.20-1.el9_4 | RHSA-2024:2387 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 8.6.0-3.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.57-9.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_proxy_cluster | 1.3.20-3.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.57-9.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.1.1k-17.el7jbcs | RHSA-2024:1316 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | mod_jk | 1.2.49-1.el9_4 | ALSA-2024:2387 |
| AlmaLinux 9 | mod_proxy_cluster | 1.3.20-1.el9_4 | ALSA-2024:2387 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | mod_jk | 1.2.49-1.el9_4 | ELSA-2024-2387 |
| Oracle Linux 9 | mod_proxy_cluster | 1.3.20-1.el9_4 | ELSA-2024-2387 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Apache mod_proxy_cluster 1.2.6 - Stored XSS EDB-52010 · webapps · May 13, 2024
GitHub 2 repositories
-
DedSec-47/CVE-2023-6710 ★ 2 · Dec 25, 2023
Explore the depths of CVE-2023-6710 with our comprehensive Proof of Concept (PoC). This CVE, identified as a potential security vulnerability, has been meticulously examined to demonstrate its impact…
-
DedSec-47/Metasploit-Exploits-CVE-2023-6710 ★ 1 · Dec 25, 2023
Welcome to the Metasploit Exploits Repository, your go-to resource for a comprehensive collection of cutting-edge exploits designed for penetration testing and ethical hacking. Developed and maintain…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- ALSA-2024:2387 Moderate: mod_jk and mod_proxy_cluster security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:1316 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2387 Red Hat Security Advisory: mod_jk and mod_proxy_cluster security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- WID-SEC-2024-0769 IBM Rational Build Forge: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 7, 2024
- ELSA-2024-2387 Moderate: mod_jk and mod_proxy_cluster security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 2, 2024
- WID-SEC-2023-3106 Apache HTTP Server (mod_proxy_cluster): Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · Mar 18, 2024
References
- RHSA-2024:1316 vendor-advisory
- RHSA-2024:1317 vendor-advisory
- RHSA-2024:2387 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-6710 vdb-entry
- RHBZ#2254128 issue-tracking