CVE-2019-10092 : In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was rep

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

Published 2019-09-26 16:15:11

Updated 2021-09-09 01:05:37

Source Apache Software Foundation

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2019-10092

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Redhat » Software Collection » Version: 1.0
cpe:2.3:a:redhat:software_collection:1.0:*:*:*:*:*:*:*
Matching versions
Apache » Http Server
Versions from including (>=) 2.4.0 and up to, including, (<=) 2.4.39
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Matching versions
Oracle » Secure Global Desktop » Version: 5.4
cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:*
Matching versions
Oracle » Secure Global Desktop » Version: 5.5
cpe:2.3:a:oracle:secure_global_desktop:5.5:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager Ops Center » Version: 12.3.3
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager Ops Center » Version: 12.4.0
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Element Manager » Version: 8.0.0
cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Element Manager » Version: 8.1.0
cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Element Manager » Version: 8.1.1
cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*
Matching versions
Oracle » Communications Element Manager » Version: 8.2.0
cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 19.04
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 30
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.0
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap
Versions up to, including, (<=) 9.5
cpe:2.3:o:netapp:clustered_data_ontap:*:*:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6
cpe:2.3:o:netapp:clustered_data_ontap:9.6:-:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P1
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p1:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P3
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p3:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P4
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p4:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P7
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p7:*:*:*:*:*:*
Matching versions
Netapp » Clustered Data Ontap » Version: 9.6 Update P8
cpe:2.3:o:netapp:clustered_data_ontap:9.6:p8:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2019-10092

Top countries where our scanners detected CVE-2019-10092

Top open port discovered on systems with this issue 80

IPs affected by CVE-2019-10092 6,623,690

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2019-10092!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2019-10092

EPSS FAQ

84.15%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-10092

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2019-10092

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-10092

https://usn.ubuntu.com/4113-1/

USN-4113-1: Apache HTTP Server vulnerabilities | Ubuntu security notices
Patch;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpujan2020.html

Oracle Critical Patch Update Advisory - January 2020
Patch;Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Aug/47

Bugtraq: [SECURITY] [DSA 4509-1] apache2 security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html

[security-announce] openSUSE-SU-2019:2051-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpuapr2020.html

Oracle Critical Patch Update Advisory - April 2020
Patch;Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E

Pony Mail!
Mailing List;Vendor Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E

Pony Mail!
Mailing List;Vendor Advisory

CVEs referencing this url
https://support.f5.com/csp/article/K30442259

Article: K30442259 - Apache HTTPD vulnerability CVE-2019-10092
Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Page not found | Oracle
Patch;Third Party Advisory

CVEs referencing this url
https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-10092-Limited%20Cross-Site%20Scripting%20in%20mod_proxy%20Error%20Page-Apache%20httpd

Disclosures/CVE-2019-10092-Limited Cross-Site Scripting in mod_proxy Error Page-Apache httpd at master · DrunkenShells/Disclosures · GitHub
Exploit;Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html

Oracle Critical Patch Update Advisory - July 2020
Patch;Third Party Advisory

CVEs referencing this url
https://httpd.apache.org/security/vulnerabilities_24.html

httpd 2.4 vulnerabilities - The Apache HTTP Server Project
Vendor Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/201909-04

Apache: Multiple vulnerabilities (GLSA 201909-04) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E

svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html s
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E

svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/ - Pony Mail
Mailing List;Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20190905-0003/

September 2019 Apache HTTP Server Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E

svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ - Pony Mail
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2020/08/08/9

oss-security - Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow
Mailing List

CVEs referencing this url
https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d@%3Ccvs.httpd.apache.org%3E

svn commit: r1073139 [12/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ - Pony Mail
Mailing List;Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Oct/24

Bugtraq: [SECURITY] [DSA 4509-3] apache2 security update
Mailing List;Third Party Advisory
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E

svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_
Mailing List;Vendor Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r0a83b112cd9701ef8a2061c8ed557f3dc9bb774d4da69fbb91bbc3c4@%3Cusers.httpd.apache.org%3E

Re: [users@httpd] Small difference on error messages - Pony Mail
Mailing List;Vendor Advisory
https://www.debian.org/security/2019/dsa-4509

Debian -- Security Information -- DSA-4509-1 apache2
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E

Pony Mail!
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4126

RHSA-2019:4126 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2020/08/08/1

oss-security - Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow
Mailing List

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2019/08/msg00034.html

[SECURITY] [DLA 1900-1] apache2 security update
Mailing List;Third Party Advisory
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E

svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_2
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7RVHJHTU4JN3ULCQ44F2G6LZBF2LGNTC/

Mailing List;Third Party Advisory
https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E

Pony Mail!
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538@%3Ccvs.httpd.apache.org%3E

svn commit: r1888194 [12/13] - /httpd/site/trunk/content/security/json/ - Pony Mail
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2019/08/15/4

oss-security - CVE-2019-10092: Limited cross-site scripting in mod_proxy
Mailing List;Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00034.html

[SECURITY] [DLA 1900-2] apache2 regression update
Mailing List;Third Party Advisory
https://lists.apache.org/thread.html/73768e31e0fcae03e12f5aa87da1cb26dece39327f3c32060baa3e94@%3Cannounce.httpd.apache.org%3E

CVE-2019-10092: Limited cross-site scripting in mod_proxy - Pony Mail
Mailing List;Vendor Advisory