REDHAT-BUG-2486419: Medium severity Apache HTTP Server vulnerability
A cross-site scripting vulnerability exists in modproxyftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy configuration.
Users are recommended to upgrade to version 2.4.68, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Server mod_proxy_ftpto a version that resolves this vulnerability.Fixed in 2.4.68
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache HTTP Server deployments using mod_proxy_ftp to generate HTML directory listings for FTP directory contents are affected when configured as either a forward proxy or a reverse proxy. The issue affects Apache HTTP Server 2.4.67 and earlier.
What does an attacker need to exploit it?
An attacker needs FTP directory content that is included in a directory listing generated by mod_proxy_ftp. The vulnerability is a cross-site scripting issue in the generated HTML listing.
What should be done if an immediate upgrade is not possible?
The provided information identifies upgrading to Apache HTTP Server 2.4.68 as the remediation. It does not provide an alternative mitigation; prioritize limiting or disabling mod_proxy_ftp HTML directory listing exposure until the upgrade can be completed.