CVE-2019-10098 Open redirect in Apache HTTP Server
Attackers can exploit encoded newlines in mod_rewrite rules to redirect users to unexpected URLs, potentially bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10098?
CVE-2019-10098 is a medium-severity vulnerability in Apache Http Server, published on 25 Sep 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.
Weakness: CWE-601
Which versions are affected by CVE-2019-10098?
It affects 1 product.
Products include Apache Http Server.
How do I fix CVE-2019-10098?
Upgrade to a fixed version.
Is CVE-2019-10098 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-10098 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2019-10098, CLEANSTART-2026-ZI95703, DEBIAN-CVE-2019-10098, GHSA-hm8m-x559-v4fw, UBUNTU-CVE-2019-10098.