A flaw was found in the modproxycluster in the Apache server. A malicious user can add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting vulnerability. by adding a script on the alias parameter on the URL it adds a new virtual host and adds the script to the cluster-manager page. The impact of this vulnerability is considered as Low as the clustermanager URL should NOT be exposed outside and protected by user/password.

Configuration of modcluster via JVMRoute longer than 80 characters will cause segfault.

A segmentation fault can occur in Apache HTTPD 2.2.

The crash is due to a strcpy buffer overflow in modcluster's modmanager.

https://github.com/modcluster/modcluster/blob/1.2.9.Final/native/modmanager/node.c#L227 [Open URL]

If clients send a request with a JVMRoute longer than 80 characters (the size of the strcpy destination), the strcpy segfaults.

Cross-site scripting (XSS) vulnerability in the manager web interface in modcluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.