CVE-2019-10092: apache http_server Cross-site Scripting

CVSS: 6.1v3.1MediumModified

AliasesALPINE-CVE-2019-10092SUSE-SU-2021:0779-1UBUNTU-CVE-2019-10092+2 more

Published 26-09-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-10092 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in apache http_server. EPSS estimates a 81.47% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

51/100

0100

High · default modelHow is this calculated?

CVSS score

6.1/10

010

Medium · v3.1 (NVD)

EPSS score

81.47%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2github, exploit-database

Advisory lineage

Upstream 0 · Downstream 12 · Related 6

DLA-1900-1 DSA-4509-1 MGASA-2019-0407 OPENSUSE-SU-2019:2051-1 OPENSUSE-SU-2024:10623-1 RHSA-2019:4126+6 more

Timeline

26-09-2019
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.16.1v2.04.3

EPSS trend

Probability

81.47%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 81.47% on 18-09-2026

18-09-202618-10-2026

EPSS score

81.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

githubUnverified
Disclosures
Maturity: poc
exploit-databasemultipleUnverified
Apache Httpd mod_proxy - Error Page Cross-Site Scripting
Maturity: poc

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Oracle3 products

communications_element_manager8.0.0 | 8.1.0 | 8.1.1 | 8.2.0
enterprise_manager_ops_center12.3.3 | 12.4.0
secure_global_desktop5.4 | 5.5

Suse3 products

apache2&distro=SUSE Linux Enterprise Server 12 SP5< 2.4.23-29.69.1
apache2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.4.23-29.69.1
apache2&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 2.4.23-29.69.1

Debian2 products

apache2< 2.4.41-1 | < 2.4.25-3+deb9u9 | < 2.4.38-3+deb10u3
debian_linuxEOL8.0 | 9.0 | 10.0

Alpine1 product

apache2< 2.4.41-r0

Apache1 product

http_server≥ 2.4.0, ≤ 2.4.39

Canonical1 product

ubuntu_linuxEOL16.04 | 18.04 | 19.04

Fedoraproject1 product

fedoraEOL30

Netapp1 product

clustered_data_ontap≤ 9.5 | 9.6 | 9.6:p1 | 9.6:p3 | 9.6:p4 | 9.6:p7 | 9.6:p8

Opensuse1 product

leapEOL15.0 | 15.1

Redhat1 product

software_collection1.0

Ubuntu1 product

apache2All versions (No fix recorded) | < 2.4.18-2ubuntu3.12 | < 2.4.29-1ubuntu4.10

11 vendors · 16 products

References

44 links

lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2019/08/15/4Mailing ListX Refsource MLISTThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
www.debian.org/security/2019/dsa-4509Vendor AdvisoryX Refsource DEBIANThird Party Advisory
seclists.org/bugtraq/2019/Aug/47Mailing ListX Refsource BUGTRAQThird Party Advisory
lists.debian.org/debian-lts-announce/2019/08/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
usn.ubuntu.com/4113-1/Vendor AdvisoryX Refsource UBUNTUPatchThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
security.netapp.com/advisory/ntap-20190905-0003/X Refsource CONFIRMThird Party Advisory

Show all 44 references

security.gentoo.org/glsa/201909-04Vendor AdvisoryX Refsource GENTOOThird Party Advisory
support.f5.com/csp/article/K30442259X Refsource CONFIRMThird Party Advisory
lists.debian.org/debian-lts-announce/2019/09/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
seclists.org/bugtraq/2019/Oct/24Mailing ListX Refsource BUGTRAQThird Party Advisory
access.redhat.com/errata/RHSA-2019:4126Vendor AdvisoryX Refsource REDHATThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
www.oracle.com/security-alerts/cpuapr2020.htmlX Refsource MISCPatchThird Party Advisory
www.oracle.com/security-alerts/cpujul2020.htmlX Refsource MISCPatchThird Party Advisory
www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCPatchThird Party Advisory
www.oracle.com/security-alerts/cpujan2020.htmlX Refsource MISCPatchThird Party Advisory
httpd.apache.org/security/vulnerabilities_24.htmlX Refsource MISCVendor Advisory
github.com/DrunkenShells/…X Refsource MISCExploitThird Party Advisory
www.openwall.com/lists/oss-security/2020/08/08/1Mailing ListX Refsource MLIST
www.openwall.com/lists/oss-security/2020/08/08/9Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
security.alpinelinux.org/vuln/CVE-2019-10092Advisory
www.suse.com/support/update/announcement/2021/suse-su-20210779-1/Advisory
bugzilla.suse.com/1145740REPORT
bugzilla.suse.com/1182703REPORT
www.suse.com/security/cve/CVE-2019-10092WEB
ubuntu.com/security/CVE-2019-10092REPORT
www.openwall.com/lists/oss-security/2019/08/15/4REPORT
ubuntu.com/security/notices/USN-4113-1Advisory
www.cve.org/CVERecord?id=CVE-2019-10092REPORT
security-tracker.debian.org/tracker/CVE-2019-10092Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities