A vulnerability was found in modproxycluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.
A flaw was found in modproxycluster. This vulnerability, a Carriage Return Line Feed (CRLF) injection in the decodeenc() function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoint responses. Exploitation requires network access to the MCMP protocol port, but no authentication is needed.
A flaw was found in the modproxycluster in the Apache server. A malicious user can add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting vulnerability. by adding a script on the alias parameter on the URL it adds a new virtual host and adds the script to the cluster-manager page. The impact of this vulnerability is considered as Low as the clustermanager URL should NOT be exposed outside and protected by user/password.
The modproxycluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.Bug Fix(es): Rebuild modproxycluster against httpd 2.4.62 (JIRA:RHEL-70140) Rebase modproxycluster to upstream 1.3.22.Final release (JIRA:RHEL-80435) Update deprecated misspeled EnableMCPMReceive directive (JIRA:RHEL-82135)
The modproxycluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.<br>Security Fix(es):<br><li> modproxycluster: modproxycluster unauthorized MCMP requests (CVE-2024-10306)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.