CVE-2023-6710

MediumCVSS 5.4/10Last modified Nov 6, 2026

Description

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Red HatJBoss Core Services for RHEL 8—
Red HatJBoss Core Services on RHEL 7—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat JBoss Core Services—
Red HatRed Hat JBoss Core Services—

References

Timeline

Published
Dec 12, 2023
Last modified
Nov 6, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-67117.5Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially CVE-2023-67176.0A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as AsseCVE-2023-67187.5An authentication bypass vulnerability has been found in Repox, which allows a remote user to send a specially crafted POST request, due to CVE-2023-67196.1An XSS vulnerability has been detected in Repox, which allows an attacker to compromise interactions between a user and the vulnerable appliCVE-2023-67205.4An XSS vulnerability stored in Repox has been identified, which allows a local attacker to store a specially crafted JavaScript payload on tCVE-2023-67217.5An XEE vulnerability has been found in Repox, which allows a remote attacker to interfere with the application's XML data processing in the CVE-2023-67227.5A path traversal vulnerability has been detected in Repox, which allows an attacker to read arbitrary files on the running server, resultingCVE-2023-67239.8An unrestricted file upload vulnerability has been identified in Repbox, which allows an attacker to upload malicious files via the transforCVE-2023-67248.8Authorization Bypass Through User-Controlled Key vulnerability in Software Engineering Consultancy Machine Equipment Limited Company HearingCVE-2023-67255.5An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND CVE-2023-67274.3Mattermost fails to perform correct authorization checks when creating a playbook action, allowing users without access to the playbook to cCVE-2023-67283.3Nokia SR OS bof.cfg file encryption is vulnerable to a brute force attack. This weakness allows an attacker in possession of the encrypted f