CVE-2024-10306
Full vulnerability record from the local CVENow database.
Description
A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.
Severity
MEDIUM
CVSS score
5.4
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-04-23 10:15:14.330000
Last modified
2026-10-21 17:17:22.940000
View original CVE JSON
{
"id": "CVE-2024-10306",
"sourceIdentifier": "[email protected]",
"published": "2025-04-23T10:15:14.330",
"lastModified": "2026-10-21T17:17:22.940",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad en mod_proxy_cluster. El problema radica en que la directiva debería reemplazarse por la directiva , ya que esta no restringe el acceso a IP/host como sugiere `Require ip IP_ADDRESS`. Esto significa que cualquier persona con acceso al host podría enviar solicitudes MCMP que podrían resultar en la adición, eliminación o actualización de nodos para el balanceo. Sin embargo, este host no debería ser accesible a la red pública, ya que no atiende el tráfico general."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/modcluster/mod_proxy_cluster",
"packageName": "mod_proxy_cluster",
"versions": [
{
"version": "1.3.17",
"lessThan": "1.3.21.Final",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mod_proxy_cluster",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"versions": [
{
"version": "0:1.3.21-1.el10",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mod_proxy_cluster",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"versions": [
{
"version": "0:1.3.22-1.el10_0.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mod_proxy_cluster",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"versions": [
{
"version": "0:1.3.22-1.el9_5.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mod_proxy_cluster",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream"
],
"versions": [
{
"version": "0:1.3.22-1.el9_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mod_proxy_cluster",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream"
],
"versions": [
{
"version": "0:1.3.22-1.el9_4.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Core Services 2.4.62",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "mod_proxy_cluster",
"cpes": [
"cpe:/a:redhat:jboss_core_services:1.0"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat JBoss Core Services",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
"packageName": "jbcs-httpd24-mod_proxy_cluster",
"cpes": [
"cpe:/a:redhat:jboss_core_services:1"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-04-23T15:30:34.381869Z",
"id": "CVE-2024-10306",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHBA-2025:2973",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHBA-2025:5309",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3453",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9434",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9466",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9997",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-10306",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321302",
"source": "[email protected]"
},
{
"url": "https://github.com/modcluster/mod_proxy_cluster/pull/309",
"source": "[email protected]"
}
]
}