{"id":"CVE-2024-10306","aliases":["ALSA-2025:9434","ALSA-2025:9466","CLSA-2026-1778858907","EUVD-2025-12236","GHSA-jm2g-3f56-rvvh","RHBA-2025:2973","RHBA-2025:5309","RHSA-2025:9434","RHSA-2025:9466","RHSA-2025:9997","RLSA-2025:9434","RLSA-2025:9466"],"status":"published","title":"Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests","description":"A vulnerability was found in mod_proxy_cluster. The issue is that the \u003cDirectory\u003e directive should be replaced by the \u003cLocation\u003e directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00381,"percentile":0.32384,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2025-04-23T09:59:49Z","modified":"2026-10-29T11:58:12Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"mod_proxy_cluster","fixed_in":["1.3.22-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"mod_proxy_cluster","fixed_in":["1.3.22-1.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster","fixed_in":["0:1.3.22-1.el9_5.2","0:1.3.22-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster-debuginfo","fixed_in":["0:1.3.22-1.el9_5.2","0:1.3.22-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster-debugsource","fixed_in":["0:1.3.22-1.el9_5.2","0:1.3.22-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"mod_proxy_cluster","fixed_in":["0:1.3.21-1.el10","0:1.3.22-1.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"mod_proxy_cluster-debuginfo","fixed_in":["0:1.3.21-1.el10","0:1.3.22-1.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"mod_proxy_cluster-debugsource","fixed_in":["0:1.3.21-1.el10","0:1.3.22-1.el10_0.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_proxy_cluster","fixed_in":["0:1.3.22-1.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_proxy_cluster-debuginfo","fixed_in":["0:1.3.22-1.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_proxy_cluster-debugsource","fixed_in":["0:1.3.22-1.el9_4.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"mod_proxy_cluster","fixed_in":["0:1.3.22-1.el9_6.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"mod_proxy_cluster","fixed_in":["0:1.3.22-1.el10_0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.22-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.22-1.el10_0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.18-1.el9.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_5.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_5.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_5.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.21-1.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.21-1.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"mod_proxy_cluster-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.21-1.el10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"mod_proxy_cluster-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"mod_proxy_cluster-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el10_0.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_proxy_cluster-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"mod_proxy_cluster-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_4.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el9_6.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"mod_proxy_cluster","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.22-1.el10_0.2"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat jboss core services"},{"vendor":"red hat","product":"red hat jboss core services 2.4.62"}],"references":[{"url":"https://access.redhat.com/errata/RHBA-2025:2973","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2025:5309","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3453","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9434","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9466","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:9997","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-10306","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2321302","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://github.com/modcluster/mod_proxy_cluster/pull/309","tags":["article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10306","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jm2g-3f56-rvvh"},{"url":"https://bugzilla.redhat.com/2321302","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-9434.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-9466.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778858907.html","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_2973.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-10306","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/10/html/10.0_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-76000","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_5309.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-81070","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9434.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9466.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-95378","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_9997.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:9434","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:9466","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-10306","title":"Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests","description":"A vulnerability was found in mod_proxy_cluster. The issue is that the \u003cDirectory\u003e directive should be replaced by the \u003cLocation\u003e directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.","status":"published","published":"2025-04-23T09:59:49.15Z","modified":"2026-10-21T16:53:50.488Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2025-12236","description":"A vulnerability was found in mod_proxy_cluster. The issue is that the \u003cDirectory\u003e directive should be replaced by the \u003cLocation\u003e directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.","status":"published","published":"2025-04-23T09:59:49Z","modified":"2026-10-21T16:53:50Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:36.259658Z"}],"ghsa":[{"id":"GHSA-jm2g-3f56-rvvh","title":"A vulnerability was found in mod_proxy_cluster. The issue is that the \u003cDirectory\u003e directive...","description":"A vulnerability was found in mod_proxy_cluster. The issue is that the \u003cDirectory\u003e directive should be replaced by the \u003cLocation\u003e directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.","status":"published","published":"2025-04-23T12:31:25Z","modified":"2026-10-06T18:32:18Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:12:51.459076Z"}],"nvd":[{"id":"CVE-2024-10306","description":"A vulnerability was found in mod_proxy_cluster. The issue is that the \u003cDirectory\u003e directive should be replaced by the \u003cLocation\u003e directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.","status":"published","published":"2025-04-23T10:15:14.33Z","modified":"2026-10-21T17:17:22.94Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:10:46.40251Z"}],"osv":[{"id":"RHBA-2025:2973","title":"Red Hat Bug Fix Advisory: mod_proxy_cluster bug fix update","status":"published","published":"2025-05-31T10:02:38Z","modified":"2026-10-07T10:03:11Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2025:5309","title":"Red Hat Bug Fix Advisory: mod_proxy_cluster bug fix and enhancement update","status":"published","published":"2025-05-15T10:02:50Z","modified":"2026-10-07T10:03:12Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2025:9434","title":"Red Hat Security Advisory: mod_proxy_cluster security update","status":"published","published":"2025-06-24T10:03:14Z","modified":"2026-10-07T10:04:42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:9466","title":"Red Hat Security Advisory: mod_proxy_cluster security update","status":"published","published":"2025-06-24T10:03:14Z","modified":"2026-10-07T10:04:42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:9997","title":"Red Hat Security Advisory: mod_proxy_cluster security update","status":"published","published":"2025-07-01T10:06:02Z","modified":"2026-10-07T10:04:44Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:9434","title":"Moderate: mod_proxy_cluster security update","description":"The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.\n\nSecurity Fix(es):\n\n* mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:54.379829Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:9466","title":"Moderate: mod_proxy_cluster security update","description":"The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.\n\nSecurity Fix(es):\n\n* mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-03T20:18:28.321597Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"ALSA-2025:9434","title":"Moderate: mod_proxy_cluster security update","description":"The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.  \n\nSecurity Fix(es):  \n\n  * mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-24T00:00:00Z","modified":"2026-10-29T11:32:30.130974526Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2025:9466","title":"Moderate: mod_proxy_cluster security update","description":"The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.  \n\nSecurity Fix(es):  \n\n  * mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-24T00:00:00Z","modified":"2026-10-29T11:58:12.674888Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"CLSA-2026-1778858907","title":"mod_proxy_cluster: Fix of 2 CVEs","description":"- CVE-2023-6710: stored XSS in mod_cluster-manager HTML output via virtual host\n  and context names rendered without HTML escaping\n- CVE-2024-10306: unauthorized MCMP requests due to \u003cDirectory\u003e directive being\n  ignored for protocol-handler filtering; runtime guard now refuses \u003cDirectory\u003e\n  siblings of EnableMCPMReceive, and the shipped conf.sample uses \u003cLocation\u003e","status":"published","published":"2026-05-15T15:28:32Z","modified":"2026-06-01T00:32:31.320023317Z","updated_at":"2026-11-02T15:43:44.737408Z"}]}}