CVE-2019-10098: Medium severity Apache HTTP Server vulnerability
A vulnerability was discovered in Apache httpd, in modrewrite. Certain self-referential modrewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers.
Other sources
A vulnerability was found in httpd where redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
— Red Hat
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-10098?
CVE-2019-10098 is a vulnerability in Apache HTTP Server from version 2.4.0 to 2.4.39.
What is the severity of CVE-2019-10098?
The severity of CVE-2019-10098 is medium with a CVSS score of 6.1.
How does CVE-2019-10098 affect Apache HTTP Server?
CVE-2019-10098 affects Apache HTTP Server by allowing certain self-referential mod_rewrite rules to be fooled by encoded newlines, leading to redirection to an unexpected location.
How can CVE-2019-10098 be exploited?
CVE-2019-10098 can be exploited by attackers in phishing attacks or as part of client-side attacks on browsers.
Where can I find more information about CVE-2019-10098?
You can find more information about CVE-2019-10098 in the references provided: [1] [2] [3].