{"answers":{"affected":"It affects 2 products.","exploited":"There is no known exploitation of CVE-2023-6710 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2023-6710 is a medium-severity cross-site scripting vulnerability in Redhat Enterprise Linux, published on 12 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2023-6710 and fix it if it is affected.\n\nWhat it is: CVE-2023-6710 is a medium-severity cross-site scripting vulnerability in Redhat Enterprise Linux, published on 12 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2023-6710 in the wild and no public exploit code.\n\nAffected product: Redhat Enterprise Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-6710/ (Markdown: https://insights.sbomify.com/CVE-2023-6710/index.md)","id":"CVE-2023-6710","markdown":"https://insights.sbomify.com/CVE-2023-6710/index.md","name":"CVE-2023-6710","record":{"aliases":["GHSA-5xpv-wgx6-ggmv"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["code_execution","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Apache mod_proxy_cluster","requires_auth":"low_privilege","summary":"Attackers can inject scripts via the alias parameter in mod_proxy_cluster, leading to stored XSS on the cluster-manager page.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"mod_proxy_cluster","vendor":"modcluster"},{"product":"enterprise_linux","vendor":"redhat"}],"cvss":{"score":5.4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.","ecosystems":[],"exploits":{"exploitdb":1,"first_seen":"2023-12-25","github_poc":2,"max_poc_stars":2,"metasploit":0,"nuclei":0,"refs":[{"date":"2023-12-25T09:50:23Z","kind":"github_poc","ref":"https://github.com/DedSec-47/CVE-2023-6710","stars":2,"title":"Explore the depths of CVE-2023-6710 with our comprehensive Proof of Concept (PoC). This CVE, identified as a potential security vulnerability, has been meticulously examined to demonstrate its impact and provide a hands-on understanding of the associated risks."},{"date":"2023-12-25T09:40:31Z","kind":"github_poc","ref":"https://github.com/DedSec-47/Metasploit-Exploits-CVE-2023-6710","stars":1,"title":"Welcome to the Metasploit Exploits Repository, your go-to resource for a comprehensive collection of cutting-edge exploits designed for penetration testing and ethical hacking. Developed and maintained by Mohamed Mounir Boudjema, this repository is crafted with a deep understanding of the evolving landscape of cybersecurity."},{"date":"2024-05-13","kind":"exploitdb","ref":"52010","stars":null,"title":"Apache mod_proxy_cluster 1.2.6 - Stored XSS"}],"tier":"poc_unverified"},"has_fix":true,"headline":"Mod_cluster/mod_proxy_cluster: stored cross site scripting","id":"CVE-2023-6710","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"redhat:enterprise_linux","products":["redhat:enterprise_linux"],"type":"xss","year":"2023"},"n_packages":0,"n_references":5,"next":{"headline":"Memory corruption in RTU500 series CMU Firmware","id":"CVE-2023-6711"},"packages":[],"prev":{"headline":"Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow","id":"CVE-2023-6709"},"products":["JBoss Core Services for RHEL 8","JBoss Core Services on RHEL 7","Red Hat Enterprise Linux 9"],"published":"2023-12-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"GPL-2.0-or-later","name":"Exploit-DB"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-09-19","vendors":["Red Hat"]},"summary":"Attackers can inject scripts via the alias parameter in mod_proxy_cluster, leading to stored XSS on the cluster-manager page.","url":"https://insights.sbomify.com/CVE-2023-6710/"}