« Volver al listado

CVE-2024-10306

Estado: AplazadaMedia (5.4)—

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Apache — MOD Proxy ClusterAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-10306",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-10306",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T15:30:34.381869Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "1.3.17",
              "lessThan": "1.3.21.Final",
              "versionType": "semver"
            }
          ],
          "packageName": "mod_proxy_cluster",
          "collectionURL": "https://github.com/modcluster/mod_proxy_cluster",
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.3.21-1.el10",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "mod_proxy_cluster",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10.0"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 10",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.3.22-1.el10_0.2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "mod_proxy_cluster",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.3.22-1.el9_5.2",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "mod_proxy_cluster",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.3.22-1.el9_6.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "mod_proxy_cluster",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "versions": [
            {
              "status": "unaffected",
              "version": "0:1.3.22-1.el9_4.1",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "mod_proxy_cluster",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Core Services",
          "packageName": "jbcs-httpd24-mod_proxy_cluster",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:jboss_core_services:1"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat JBoss Core Services",
          "packageName": "mod_proxy_cluster",
          "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-04-23T10:15:14.330",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHBA-2025:2973",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHBA-2025:5309",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:9434",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:9466",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2025:9997",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2024-10306",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321302",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/modcluster/mod_proxy_cluster/pull/309",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic."
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en mod_proxy_cluster. El problema radica en que la directiva  debería reemplazarse por la directiva , ya que esta no restringe el acceso a IP/host como sugiere `Require ip IP_ADDRESS`. Esto significa que cualquier persona con acceso al host podría enviar solicitudes MCMP que podrían resultar en la adición, eliminación o actualización de nodos para el balanceo. Sin embargo, este host no debería ser accesible a la red pública, ya que no atiende el tráfico general."
    }
  ],
  "lastModified": "2026-06-30T00:16:47.537",
  "sourceIdentifier": "secalert@redhat.com"
}