5.4
Medium
CVE-2023-6710 Mod_cluster/mod_proxy_cluster: stored cross site scripting
Description
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitable remotely over the network, with an ordinary account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- Interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| JBoss Core Services for RHEL 8 | Versions not published | |
| JBoss Core Services on RHEL 7 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Text-Only JBCS | Versions not published | |
| Red Hat JBoss Core Services | Versions not published |
Other CVEs of JBoss Core Services for RHEL 8
The 7 CVEs of JBoss Core Services for RHEL 8 →
CVE-2026-49975
Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service…
Not rated
CVE-2026-42536
Heap-based Buffer Overflow vulnerability in Apache HTTP Server with mod_xml2enc, xml2StartParse, and untrusted content…
Not rated
CVE-2026-44185
Buffer Over-read vulnerability in Apache HTTP Server via outbound OCSP requests to an attacker controlled OCSP server…
Not rated
CVE-2026-34355
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67 and earlier allows an attack by an untrusted backend
Not rated