CVE-2023-6710
Fixed in a distro release EPSS 2%CVSS 5.4
A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.
Products: Red Hat JBoss Core Services for RHEL 8, Red Hat JBoss Core Services on RHEL 7, Red Hat Enterprise Linux 9
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 9 | mod_jk | 1.2.49-1.el9_4 |
| AlmaLinux 9 | mod_proxy_cluster | 1.3.20-1.el9_4 |
| Red Hat Enterprise Linux 9 | mod_jk | 0:1.2.49-1.el9_4 |
| Red Hat Enterprise Linux 9 | mod_jk-debuginfo | 0:1.2.49-1.el9_4 |
| Red Hat Enterprise Linux 9 | mod_jk-debugsource | 0:1.2.49-1.el9_4 |
| Red Hat Enterprise Linux 9 | mod_proxy_cluster | 0:1.3.20-1.el9_4 |
| Red Hat Enterprise Linux 9 | mod_proxy_cluster-debuginfo | 0:1.3.20-1.el9_4 |
| Red Hat Enterprise Linux 9 | mod_proxy_cluster-debugsource | 0:1.3.20-1.el9_4 |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.6.0-3.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.6.0-3.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.6.0-3.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.6.0-3.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools-debuginfo | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.6.0-3.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.6.0-3.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-debuginfo | 0:8.6.0-3.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.6.0-3.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.6.0-3.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap-debuginfo | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster | 0:1.3.20-3.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster | 0:1.3.20-3.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster-debuginfo | 0:1.3.20-3.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_cluster-debuginfo | 0:1.3.20-3.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html-debuginfo | 1:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session-debuginfo | 0:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-9.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl-debuginfo | 1:2.4.57-9.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.1.1k-17.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.1.1k-17.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.1.1k-17.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.1.1k-17.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.1.1k-17.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.1.1k-17.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.1.1k-17.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.1.1k-17.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs-debuginfo | 1:1.1.1k-17.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.1.1k-17.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.1.1k-17.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.1.1k-17.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.1.1k-17.el8jbcs |