|Description||In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
|References||DLA-1900-1, DSA-4509-1, DSA-4509-3|
Vulnerable and fixed packages
The table below lists information on source packages.
|apache2 (PTS)||stretch (security), stretch||2.4.25-3+deb9u9||fixed|
|buster, buster (security)||2.4.38-3+deb10u4||fixed|
The information below is based on the following data on fixed versions.
Affects upstream versions 2.4.0 to 2.4.39