high CVSS 8 EPSS 81% Public exploit available

CVE-2019-10092·Apache vulnerability

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

Severity
high
Software
Apache
Fixed in
2.4.41-1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 81% — in the top 0.4% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 2.4.41-1

Fixed in: 2.4.41-1

How to fix this CVE

Upgrade Apache HTTP Server to version 2.4.41-1 or later to patch the mod_proxy XSS vulnerability. If you are running Apache with proxy modules enabled, ensure your configuration does not serve error pages that could redirect users to attacker-controlled destinations. Review your mod_proxy settings and disable unnecessary proxy features if they are not required for your application.

sudo dnf update httpd httpd-tools

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET|POST request to a proxied endpoint that triggers an error page, with crafted parameters containing special characters or URL-encoded payloads designed to break out of the href attribute; look for patterns like '/?<script>' or encoded entities in proxy error responses

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement WAF rules to block requests to proxy error pages that contain JavaScript, data: URIs, or URL fragments (# character) in query parameters. Apply output encoding rules to ensure all user-supplied input reflected in proxy error messages is properly HTML-escaped.

How to check if you are affected

  1. Run 'apache2ctl -v' or 'httpd -v' to check your installed Apache version; versions 2.4.0 through 2.4.39 are vulnerable
  2. Verify mod_proxy is loaded by running 'apache2ctl -M | grep proxy' or checking your Apache modules directory for proxy_module.so
  3. Search Apache error logs for requests containing unusual URL parameters or encoded characters in proxy error page URLs: grep -i 'proxy' /var/log/apache2/error.log | grep -E '(href|Location|javascript|data:)'
  4. After patching, confirm the new version with 'apache2ctl -v' and restart Apache with 'sudo systemctl restart apache2' or 'sudo service apache2 restart', then verify it is running with 'sudo systemctl status apache2'

FAQ

What is CVE-2019-10092?

CVE-2019-10092 is a limited cross-site scripting vulnerability in Apache mod_proxy that allows attackers to manipulate error page links when the server is misconfigured with proxy settings. An attacker can craft a request that causes the error page to display a malicious link pointing to an external site.

Is CVE-2019-10092 being actively exploited?

CVE-2019-10092 is not listed on the CISA Known Exploited Vulnerabilities catalog; however, public exploits are available on Exploit-DB, making opportunistic exploitation possible.

What versions of Apache are affected by CVE-2019-10092?

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable. The vulnerability is fixed in version 2.4.41-1 and later.

How do I check if my server is vulnerable to CVE-2019-10092?

Run 'apache2ctl -v' and check if your version is between 2.4.0 and 2.4.39. Additionally, run 'apache2ctl -M | grep proxy' to confirm proxy modules are loaded; vulnerability only applies if mod_proxy is enabled.

Does Defensia detect CVE-2019-10092?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Apache is installed on a monitored server, CVE-2019-10092 will appear in your dashboard with remediation steps.

Related Apache CVEs

CVE-2026-29167CVSS 10Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2026-44631CVSS 10Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue.
CVE-2021-41773CVSS 10A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVE-2021-42013CVSS 10It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2021-44790CVSS 10A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2019-10092. Free for 1 server.

Get started free