CVE-2019-10092

82

FAUCET Score

CVE-2019-10092 is a limited cross-site scripting (XSS) vulnerability affecting Apache HTTP Server versions 2.4.0 through 2.4.39, as well as various distributions like Debian, Red Hat, and Oracle. This medium-severity flaw (CVSS 6.1) allows an attacker to manipulate the mod_proxy error page to redirect users to an attacker-controlled site, requiring user interaction and specific server misconfigurations. While not on the CISA KEV catalog, public exploit code exists via ExploitDB and Nuclei templates, and it has garnered some community discussion and media coverage, indicating awareness among security researchers.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.4.0, <= 2.4.39CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		15.0CPE matchmatch criteria	cpe:2.3:o:opensuse:leap:15.0:::::::*
		15.1CPE matchmatch criteria	cpe:2.3:o:opensuse:leap:15.1:::::::*
		8.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:8.0:::::::*
		9.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:9.0:::::::*

CVSS Data

CVSS version used by this source: 3.1

6.1MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

Exploitability Score

2.8

Impact Score

2.7

CvssVersion

3.1

Exploit Intelligence

EPSS Score

81.47%

Probability of exploitation in next 30 days

EPSS Percentile

99.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

Nuclei: CVE-2019-10092 · Jan 9, 2021

ExploitDB: EDB-47688 · Oct 14, 2019

This CVE's current EPSS score of 0.8147 is in the 100th percentile among its peer group of 26,209 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (32)

apachepatch availablevia llm_extracted

Fixed in: 2.4

oraclepatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-apr-0:1.6.3-86.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apr-0:1.6.3-86.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-brotli-0:1.0.6-21.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.37-52.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.12-41.Final_redhat_2.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_http2-0:1.11.3-22.jbcs.el7

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-openssl-1:1.1.1c-16.jbcs.el7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: httpd:2.4-8030020200818000036.30b713e6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-httpd-0:2.4.34-15.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-nghttp2-0:1.7.1-8.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-0:1.1-19.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-httpd-0:2.4.34-15.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-nghttp2-0:1.7.1-8.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: httpd24-0:1.1-19.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: httpd24-httpd-0:2.4.34-15.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: httpd24-nghttp2-0:1.7.1-8.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-0:1.1-19.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-httpd-0:2.4.34-15.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-nghttp2-0:1.7.1-8.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: httpd24-0:1.1-19.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: httpd24-httpd-0:2.4.34-15.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: httpd24-nghttp2-0:1.7.1-8.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-0:1.1-19.el6

redhatpatch availablevia redhat_api

Product: JBoss Core Services Apache HTTP Server 2.4.37 SP2Fixed in: httpd

redhatvendor investigatingvia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: httpd

Vendor Advisories (4)

apachellm-apache-f398f8ed28802aa3LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

apachellm-apache-a7a91ec4c0e9421dHIGH

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

redhatCVE-2019-10092Low

httpd: limited cross-site scripting in mod_proxy error page

apachellm-apache-684e4d0003611bd4LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

References

lists.opensuse.org / opensuse-security-announce/2019-09/msg00004.html

Mailing ListThird Party Advisory

access.redhat.com / errata/RHSA-2019:4126

Third Party Advisory

github.com / DrunkenShells/Disclosures/tree/master/CVE-2019-10092-Limited%20Cross-Site%20Scripting%20in%20mod_proxy%20Error%20Page-Apache%20httpd

ExploitThird Party Advisory

httpd.apache.org / security/vulnerabilities_24.html

Vendor Advisory

lists.apache.org / thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/73768e31e0fcae03e12f5aa87da1cb26dece39327f3c32060baa3e94%40%3Cannounce.httpd.apache.org%3E

lists.apache.org / thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r0a83b112cd9701ef8a2061c8ed557f3dc9bb774d4da69fbb91bbc3c4%40%3Cusers.httpd.apache.org%3E

lists.apache.org / thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

lists.apache.org / thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

lists.debian.org / debian-lts-announce/2019/08/msg00034.html

Mailing ListThird Party Advisory

lists.debian.org / debian-lts-announce/2019/09/msg00034.html

Mailing ListThird Party Advisory

lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/7RVHJHTU4JN3ULCQ44F2G6LZBF2LGNTC

seclists.org / bugtraq/2019/Aug/47

Mailing ListThird Party Advisory

seclists.org / bugtraq/2019/Oct/24

Mailing ListThird Party Advisory

security.gentoo.org / glsa/201909-04

Third Party Advisory

security.netapp.com / advisory/ntap-20190905-0003

Third Party Advisory

support.f5.com / csp/article/K30442259

Third Party Advisory

usn.ubuntu.com / 4113-1

PatchThird Party Advisory

debian.org / security/2019/dsa-4509

Third Party Advisory

oracle.com / security-alerts/cpuapr2020.html

PatchThird Party Advisory

oracle.com / security-alerts/cpujan2020.html

PatchThird Party Advisory

oracle.com / security-alerts/cpujul2020.html

PatchThird Party Advisory

oracle.com / technetwork/security-advisory/cpuoct2019-5072832.html

PatchThird Party Advisory

openwall.com / lists/oss-security/2019/08/15/4

Mailing ListThird Party Advisory

openwall.com / lists/oss-security/2020/08/08/1

Mailing List

openwall.com / lists/oss-security/2020/08/08/9

Mailing List