CVE-2015-0298: redhat mod_cluster Cross-site Scripting

CVSS: 4.3v2.0MediumModified

AliasesRHEA-2015:0944RHEA-2015:0945

Published 24-08-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-0298 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in redhat mod_cluster. EPSS estimates a 1.85% chance of exploitation in the next 30 days, higher than 78.7% of scored vulnerabilities.

Overall risk

18/100

0100

Low · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

1.85%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4

RHSA-2015:0846 RHSA-2015:0847 RHSA-2015:0848 RHSA-2015:1642

Timeline

24-08-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

1.85%

Chance of exploitation in the next 30 days

Percentile

79%

Versus all other CVEs

30-day change

0.00 pp

From 1.85% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.85%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Redhat92 products

mod_cluster≤ 1.3.1
apache-commons-collections-eap6< 0:3.2.1-15.redhat_3.1.ep6.el7 | < 0:3.2.1-15.redhat_3.1.ep6.el6
apache-commons-collections-tomcat-eap6< 0:3.2.1-15.redhat_3.1.ep6.el7 | < 0:3.2.1-15.redhat_3.1.ep6.el6
apache-commons-daemon-eap6< 1:1.0.15-8.redhat_1.ep6.el7 | < 1:1.0.15-8.redhat_1.ep6.el6
apache-commons-daemon-jsvc-eap6< 1:1.0.15-9.redhat_2.ep7.el7 | < 1:1.0.15-9.redhat_2.ep7.el6

apache-commons-daemon-jsvc-eap6-debuginfo< 1:1.0.15-9.redhat_2.ep7.el7 | < 1:1.0.15-9.redhat_2.ep7.el6
apache-commons-dbcp-eap6< 0:1.4-13.1.redhat_2.ep6.el7 | < 0:1.4-13.1.redhat_2.ep6.el6
apache-commons-dbcp-tomcat-eap6< 0:1.4-13.1.redhat_2.ep6.el7 | < 0:1.4-13.1.redhat_2.ep6.el6
apache-commons-pool-eap6< 0:1.6.0-1.redhat_7.1.ep6.el7 | < 0:1.6.0-1.redhat_7.1.ep6.el6
apache-commons-pool-tomcat-eap6< 0:1.6.0-1.redhat_7.1.ep6.el7 | < 0:1.6.0-1.redhat_7.1.ep6.el6
apr-jws3< 0:1.4.8-6.ep7.el6
apr-jws3-debuginfo< 0:1.4.8-6.ep7.el6
apr-jws3-devel< 0:1.4.8-6.ep7.el6
apr-util-jws3< 0:1.5.2-8.ep7.el6
apr-util-jws3-debuginfo< 0:1.5.2-8.ep7.el6
apr-util-jws3-devel< 0:1.5.2-8.ep7.el6
apr-util-jws3-ldap< 0:1.5.2-8.ep7.el6
apr-util-jws3-mysql< 0:1.5.2-8.ep7.el6
apr-util-jws3-nss< 0:1.5.2-8.ep7.el6
apr-util-jws3-odbc< 0:1.5.2-8.ep7.el6
apr-util-jws3-openssl< 0:1.5.2-8.ep7.el6
apr-util-jws3-pgsql< 0:1.5.2-8.ep7.el6
apr-util-jws3-sqlite< 0:1.5.2-8.ep7.el6
c3p0< 0:0.9.5-7.redhat_1.1.ep7.el7 | < 0:0.9.5-7.redhat_1.1.ep7.el6
dom4j-eap6< 0:1.6.1-20.redhat_6.1.ep6.el7 | < 0:1.6.1-20.redhat_6.1.ep6.el6
eap6< 0:1-1.el7
eap6-ecj< 0:4.4.2-1.redhat_1.1.ep6.el7
eap6-runtime< 0:1-1.el7
ecj-eap6< 0:4.4.2-1.redhat_1.1.ep6.el6
hibernate-jpa-2.0-api< 0:1.0.1-6.Final_redhat_3.1.ep6.el7 | < 0:1.0.1-6.Final_redhat_3.1.ep6.el6
hibernate3-commons-annotations< 0:4.0.2-1.Final_redhat_1.1.ep6.el7 | < 0:4.0.2-1.Final_redhat_1.1.ep6.el6
hibernate3-commons-annotations-javadoc< 0:4.0.2-1.Final_redhat_1.1.ep6.el7 | < 0:4.0.2-1.Final_redhat_1.1.ep6.el6
hibernate4-c3p0-eap6< 0:4.2.18-2.Final_redhat_2.1.ep6.el7 | < 0:4.2.18-2.Final_redhat_2.1.ep6.el6
hibernate4-core-eap6< 0:4.2.18-2.Final_redhat_2.1.ep6.el7 | < 0:4.2.18-2.Final_redhat_2.1.ep6.el6
hibernate4-eap6< 0:4.2.18-2.Final_redhat_2.1.ep6.el7 | < 0:4.2.18-2.Final_redhat_2.1.ep6.el6
hibernate4-entitymanager-eap6< 0:4.2.18-2.Final_redhat_2.1.ep6.el7 | < 0:4.2.18-2.Final_redhat_2.1.ep6.el6
hibernate4-envers-eap6< 0:4.2.18-2.Final_redhat_2.1.ep6.el7 | < 0:4.2.18-2.Final_redhat_2.1.ep6.el6
httpd24< 0:2.4.6-56.ep7.el7 | < 0:2.4.6-56.ep7.el6
httpd24-debuginfo< 0:2.4.6-56.ep7.el7 | < 0:2.4.6-56.ep7.el6
httpd24-devel< 0:2.4.6-56.ep7.el7 | < 0:2.4.6-56.ep7.el6
httpd24-manual< 0:2.4.6-56.ep7.el7 | < 0:2.4.6-56.ep7.el6
httpd24-tools< 0:2.4.6-56.ep7.el7 | < 0:2.4.6-56.ep7.el6
javassist-eap6< 0:3.18.1-6.GA_redhat_1.1.ep6.el7 | < 0:3.18.1-6.GA_redhat_1.1.ep6.el6
jboss-logging< 0:3.1.4-2.GA_redhat_2.1.ep6.el7 | < 0:3.1.4-2.GA_redhat_2.1.ep6.el6
jboss-transaction-api_1.1_spec< 0:1.0.1-13.Final_redhat_3.1.ep6.el7 | < 0:1.0.1-13.Final_redhat_3.1.ep6.el6
log4j-eap6< 0:1.2.16-11.redhat_2.ep6.el7.4 | < 0:1.2.16-11.redhat_2.ep6.el6.4
mchange-commons-java< 0:0.2.9-2.redhat_2.1.ep7.el7 | < 0:0.2.9-2.redhat_2.1.ep7.el6
mod_auth_kerb-eap6< 0:5.4-30.ep7.el7 | < 0:5.4-30.ep7.el6
mod_auth_kerb-eap6-debuginfo< 0:5.4-30.ep7.el7 | < 0:5.4-30.ep7.el6
mod_bmx< 0:0.9.5-4.GA.ep7.el7 | < 0:0.9.5-4.GA.ep7.el6
mod_bmx-debuginfo< 0:0.9.5-4.GA.ep7.el7 | < 0:0.9.5-4.GA.ep7.el6
mod_cluster< 0:1.3.1-5.Final_redhat_2.1.ep7.el7 | < 0:1.3.1-5.Final_redhat_2.1.ep7.el6
mod_cluster-demo< 0:1.3.1-5.Final_redhat_2.1.ep7.el7 | < 0:1.3.1-5.Final_redhat_2.1.ep7.el6
mod_cluster-native< 0:1.3.1-5.Final_redhat_2.ep7.el7 | < 0:1.3.1-5.Final_redhat_2.ep7.el6
mod_cluster-native-debuginfo< 0:1.3.1-5.Final_redhat_2.ep7.el7 | < 0:1.3.1-5.Final_redhat_2.ep7.el6
mod_cluster-tomcat7< 0:1.3.1-5.Final_redhat_2.1.ep7.el7 | < 0:1.3.1-5.Final_redhat_2.1.ep7.el6
mod_cluster-tomcat8< 0:1.3.1-5.Final_redhat_2.1.ep7.el7 | < 0:1.3.1-5.Final_redhat_2.1.ep7.el6
mod_jk< 0:1.2.40-7.redhat_1.ep7.el7 | < 0:1.2.40-7.redhat_1.ep7.el6
mod_jk-ap24< 0:1.2.40-7.redhat_1.ep7.el7 | < 0:1.2.40-7.redhat_1.ep7.el6
mod_jk-debuginfo< 0:1.2.40-7.redhat_1.ep7.el7 | < 0:1.2.40-7.redhat_1.ep7.el6
mod_jk-manual< 0:1.2.40-7.redhat_1.ep7.el7 | < 0:1.2.40-7.redhat_1.ep7.el6
mod_ldap24< 0:2.4.6-56.ep7.el7 | < 0:2.4.6-56.ep7.el6
mod_proxy24_html< 1:2.4.6-56.ep7.el7 | < 1:2.4.6-56.ep7.el6
mod_rt< 0:2.4.1-11.GA.ep7.el7 | < 0:2.4.1-11.GA.ep7.el6
mod_rt-debuginfo< 0:2.4.1-11.GA.ep7.el7 | < 0:2.4.1-11.GA.ep7.el6
mod_security-jws3< 0:2.8.0-5.GA.ep7.el7 | < 0:2.8.0-5.GA.ep7.el6
mod_security-jws3-debuginfo< 0:2.8.0-5.GA.ep7.el7 | < 0:2.8.0-5.GA.ep7.el6
mod_session24< 0:2.4.6-56.ep7.el7 | < 0:2.4.6-56.ep7.el6
mod_ssl24< 1:2.4.6-56.ep7.el7 | < 1:2.4.6-56.ep7.el6
storeconfig-tc7< 0:0.0.1-7.Alpha3_redhat_12.5.ep6.el7 | < 0:0.0.1-7.Alpha3_redhat_12.5.ep6.el6
tomcat-native< 0:1.1.32-2.redhat_2.ep7.el7 | < 0:1.1.32-2.redhat_2.ep7.el6
tomcat-native-debuginfo< 0:1.1.32-2.redhat_2.ep7.el7 | < 0:1.1.32-2.redhat_2.ep7.el6
tomcat7< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat7-admin-webapps< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat7-docs-webapp< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat7-el-2.2-api< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat7-javadoc< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat7-jsp-2.2-api< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat7-lib< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat7-log4j< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat7-servlet-3.0-api< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat7-webapps< 0:7.0.59-16_patch_00.ep7.el7 | < 0:7.0.59-16_patch_00.ep7.el6
tomcat8< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6
tomcat8-admin-webapps< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6
tomcat8-docs-webapp< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6
tomcat8-el-2.2-api< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6
tomcat8-javadoc< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6
tomcat8-jsp-2.3-api< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6
tomcat8-lib< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6
tomcat8-log4j< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6
tomcat8-servlet-3.1-api< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6
tomcat8-webapps< 0:8.0.18-15_patch_00.ep7.el7 | < 0:8.0.18-15_patch_00.ep7.el6

Show all 92

1 vendor · 92 products

References

13 links

rhn.redhat.com/errata/RHSA-2015-1641.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2015-1642.htmlVendor AdvisoryX Refsource REDHAT
issues.jboss.org/browse/MODCLUSTER-453X Refsource CONFIRM
access.redhat.com/errata/RHEA-2015:0944Advisory
bugzilla.redhat.com/show_bug.cgi?id=1164673REPORT
security.access.redhat.com/data/csaf/v2/advisories/2015/rhea-2015_0944.jsonAdvisory
access.redhat.com/security/cve/CVE-2015-0298REPORT
bugzilla.redhat.com/show_bug.cgi?id=1197769REPORT
www.cve.org/CVERecord?id=CVE-2015-0298Advisory
nvd.nist.gov/vuln/detail/CVE-2015-0298Advisory

Show all 13 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities