PT-2025-17610 · Unknown+3 · Mod Proxy Cluster+3
Published
2025-02-28
·
Updated
2025-06-30
·
CVE-2024-10306
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
mod proxy cluster (affected versions not specified)
Description
A vulnerability was found in mod proxy cluster, where the
<Directory> directive does not restrict IP/host access as Require ip IP ADDRESS would suggest, allowing anyone with access to the host to send MCMP requests that may result in adding, removing, or updating nodes for the balancing. The host should not be accessible to the public network as it does not serve general traffic.Recommendations
As a temporary workaround, consider restricting access to the
<Directory> directive until the issue is resolved by replacing it with the <Location> directive.
Restrict access to the host to minimize the risk of exploitation, ensuring it is not accessible to the public network.Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Red Hat
Rocky Linux
Mod Proxy Cluster