What’s Vulnerable › Vulnerabilities

CVE-2019-10092

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 81.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-26 · updated 2026-06-17
• Weakness: CWE-79

Description

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

Affected products

• Apache HTTP Server: from 2.4.0 through 2.4.39
• Canonical Ubuntu Linux: 16.04, 18.04, 19.04
• Debian Linux: 8.0, 9.0, 10.0
• Fedoraproject Fedora: 30
• Clustered Data ONTAP: through 9.5; 9.6, 9.6-p1, 9.6-p3, 9.6-p4, 9.6-p7, 9.6-p8
• openSUSE Leap: 15.0, 15.1
• Oracle Communications Element Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
• Oracle Corporation Enterprise Manager Ops Center: 12.3.3, 12.4.0
• Oracle Corporation Secure Global Desktop: 5.4, 5.5
• RedHat Software Collection: 1.0

References

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html
• http://www.openwall.com/lists/oss-security/2019/08/15/4
• http://www.openwall.com/lists/oss-security/2020/08/08/1
• http://www.openwall.com/lists/oss-security/2020/08/08/9
• https://access.redhat.com/errata/RHSA-2019:4126
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-10092-Limited%20Cross-Site%20Scripting%20in%20mod_proxy%20Error%20Page-Apache%20httpd
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/73768e31e0fcae03e12f5aa87da1cb26dece39327f3c32060baa3e94%40%3Cannounce.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r0a83b112cd9701ef8a2061c8ed557f3dc9bb774d4da69fbb91bbc3c4%40%3Cusers.httpd.apache.org%3E

Get alerted when CVE-2019-10092 or the next vulnerability affects your stack