# CVE-2023-6710: Mod_cluster/mod_proxy_cluster: stored cross site scripting

> Attackers can inject scripts via the alias parameter in mod_proxy_cluster, leading to stored XSS on the cluster-manager page.

- **Severity:** Medium 5.4 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 12 Dec 2023
- **Updated:** 19 Sep 2026
- **Also known as:** GHSA-5xpv-wgx6-ggmv

## What is CVE-2023-6710?

CVE-2023-6710 is a medium-severity cross-site scripting vulnerability in Redhat Enterprise Linux, published on 12 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

### Official description

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)

## Which versions are affected by CVE-2023-6710?

It affects 2 products.


Products: Modcluster Mod Proxy Cluster, Redhat Enterprise Linux.

## How do I fix CVE-2023-6710?

Apply the vendor's patch.

## Is CVE-2023-6710 being exploited?

There is no known exploitation of CVE-2023-6710 in the wild and no public exploit code.

Public exploit code:

- Explore the depths of CVE-2023-6710 with our comprehensive Proof of Concept (PoC). This CVE, identified as a potential security vulnerability, has been meticulously examined to demonstrate its impact and provide a hands-on understanding of the associated risks. (github_poc): https://github.com/DedSec-47/CVE-2023-6710
- Welcome to the Metasploit Exploits Repository, your go-to resource for a comprehensive collection of cutting-edge exploits designed for penetration testing and ethical hacking. Developed and maintained by Mohamed Mounir Boudjema, this repository is crafted with a deep understanding of the evolving landscape of cybersecurity. (github_poc): https://github.com/DedSec-47/Metasploit-Exploits-CVE-2023-6710
- Apache mod_proxy_cluster 1.2.6 - Stored XSS (exploitdb)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2023-6710 and fix it if it is affected.

What it is: CVE-2023-6710 is a medium-severity cross-site scripting vulnerability in Redhat Enterprise Linux, published on 12 Dec 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of CVE-2023-6710 in the wild and no public exploit code.

Affected product: Redhat Enterprise Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2023-6710/ (Markdown: https://insights.sbomify.com/CVE-2023-6710/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2023-6710
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-6710
- OSV: https://osv.dev/vulnerability/CVE-2023-6710

---
From sbomify Insights: https://insights.sbomify.com/CVE-2023-6710/
Summaries are generated and may contain mistakes; the official description above is the record.