Every CVE Search/ Get API key

CVE-2024-10306

Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests

5.4 MediumFix available

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as Require ip IP_ADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.38%Up 0.4 points since Apr 23, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.4

Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as Require ip IP_ADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

Record
CVE-2024-10306
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2025-12236 5.4

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as Require ip IP_ADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

Record
EUVD-2025-12236
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-jm2g-3f56-rvvh 5.4

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive...

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as Require ip IP_ADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

Record
GHSA-jm2g-3f56-rvvh
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
NVD 5.4

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as Require ip IP_ADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

Record
CVE-2024-10306
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVRHBA-2025:2973 5.4

Red Hat Bug Fix Advisory: mod_proxy_cluster bug fix update

Record
RHBA-2025:2973
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHBA-2025:5309 5.4

Red Hat Bug Fix Advisory: mod_proxy_cluster bug fix and enhancement update

Record
RHBA-2025:5309
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 8 moreShow less
OSVRHSA-2025:9434 5.4

Red Hat Security Advisory: mod_proxy_cluster security update

Record
RHSA-2025:9434
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2025:9466 5.4

Red Hat Security Advisory: mod_proxy_cluster security update

Record
RHSA-2025:9466
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2025:9997 5.4

Red Hat Security Advisory: mod_proxy_cluster security update

Record
RHSA-2025:9997
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2025:9434 5.4

Moderate: mod_proxy_cluster security update

The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.

Security Fix(es):

  • mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:9434
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2025:9466 5.4

Moderate: mod_proxy_cluster security update

The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.

Security Fix(es):

  • mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:9466
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2025:9434 No score

Moderate: mod_proxy_cluster security update

The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.

Security Fix(es):

  • mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:9434
Updated
2026-11-02
OSVALSA-2025:9466 No score

Moderate: mod_proxy_cluster security update

The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.

Security Fix(es):

  • mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:9466
Updated
2026-11-02
OSVCLSA-2026-1778858907 No score

mod_proxy_cluster: Fix of 2 CVEs

  • CVE-2023-6710: stored XSS in mod_cluster-manager HTML output via virtual host and context names rendered without HTML escaping
  • CVE-2024-10306: unauthorized MCMP requests due to <Directory> directive being ignored for protocol-handler filtering; runtime guard now refuses <Directory> siblings of EnableMCPMReceive, and the shipped conf.sample uses <Location>
Record
CLSA-2026-1778858907
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mod_proxy_cluster
AlmaLinux:9
 before 1.3.22-1.el9_6.1
1.3.22-1.el9_6.1
mod_proxy_cluster
AlmaLinux:10
 before 1.3.22-1.el10_0.2
1.3.22-1.el10_0.2
mod_proxy_cluster
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 1.3.18-1.el9.tuxcare.els1
1.3.18-1.el9.tuxcare.els1
mod_proxy_cluster
Red Hat:enterprise_linux:9::appstream
 before 0:1.3.22-1.el9_5.2
0:1.3.22-1.el9_5.2
mod_proxy_cluster-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.3.22-1.el9_5.2
0:1.3.22-1.el9_5.2
mod_proxy_cluster-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.3.22-1.el9_5.2
0:1.3.22-1.el9_5.2
mod_proxy_cluster
Red Hat:enterprise_linux:10.0
 before 0:1.3.21-1.el10
0:1.3.21-1.el10
mod_proxy_cluster-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:1.3.21-1.el10
0:1.3.21-1.el10
mod_proxy_cluster-debugsource
Red Hat:enterprise_linux:10.0
 before 0:1.3.21-1.el10
0:1.3.21-1.el10
mod_proxy_cluster
Red Hat:enterprise_linux:9::appstream
 before 0:1.3.22-1.el9_6.1
0:1.3.22-1.el9_6.1
Show 10 moreShow less
Affected packages
PackageAffectedFixed
mod_proxy_cluster-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.3.22-1.el9_6.1
0:1.3.22-1.el9_6.1
mod_proxy_cluster-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.3.22-1.el9_6.1
0:1.3.22-1.el9_6.1
mod_proxy_cluster
Red Hat:enterprise_linux:10.0
 before 0:1.3.22-1.el10_0.2
0:1.3.22-1.el10_0.2
mod_proxy_cluster-debuginfo
Red Hat:enterprise_linux:10.0
 before 0:1.3.22-1.el10_0.2
0:1.3.22-1.el10_0.2
mod_proxy_cluster-debugsource
Red Hat:enterprise_linux:10.0
 before 0:1.3.22-1.el10_0.2
0:1.3.22-1.el10_0.2
mod_proxy_cluster
Red Hat:rhel_eus:9.4::appstream
 before 0:1.3.22-1.el9_4.1
0:1.3.22-1.el9_4.1
mod_proxy_cluster-debuginfo
Red Hat:rhel_eus:9.4::appstream
 before 0:1.3.22-1.el9_4.1
0:1.3.22-1.el9_4.1
mod_proxy_cluster-debugsource
Red Hat:rhel_eus:9.4::appstream
 before 0:1.3.22-1.el9_4.1
0:1.3.22-1.el9_4.1
mod_proxy_cluster
Rocky Linux:9
 before 0:1.3.22-1.el9_6.1
0:1.3.22-1.el9_6.1
mod_proxy_cluster
Rocky Linux:10
 before 0:1.3.22-1.el10_0.2
0:1.3.22-1.el10_0.2

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-10306 is a medium vulnerability (CVSS 5.4) in Red Hat Enterprise Linux 10, published April 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in mod_proxy_cluster 1.3.22-1.el9_6.1.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open