CVE-2019-10098observed exploitationCWE-601

CVE-2019-10098: vulnerability in Apache HTTP Server

Published 25 Sep 2019 · Updated 04 Aug 2024

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 74%

from disclosure to weapon19 days

Published on NVDSep 25

1st PoC+19d

VulnCheck+881d

exploitation probability

74%top 1% of all CVEs

observed exploitation

yesVulnCheck

1 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Affected

4 products (12 components)

Red Hat Enterprise Linux 6 · Red Hat JBoss Enterprise Web Server 2 · Red Hat Enterprise Linux 5 · Red Hat JBoss Web Server 3

workaround: This flaw requires the use of certain Rewrite configuration directives. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*Rewrite' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html

Fixed

16 products (409 components)

Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat JBoss Core Services on RHEL 6 Server · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) · and others 11

fix ↗

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

Affected products

n/a · Apache HTTP Server

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/47689unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References