Mod Cluster CVEs and Security Vulnerabilities

CVE-2016-4459

mod_cluster: Buffer overflow in mod_manager when sending request with long JVMRoute

Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Core Services Jboss Enterprise Application Platform and 1 more

CVE-2015-0298

mod_cluster: JavaScript code injection is possible via MCMP mod_manager messages

Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.

CVSS 2.0 · 4.3 Medium EPSS 1.8% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Enterprise Web Server Mod Cluster

CVE-2012-1154

mod_cluster registers and exposes the root context of a server by default, despite ROOT being in the excluded-contexts list

mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 2.6% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Enterprise Web Platform Jboss Enterprise Web Server and 1 more

Search vulnerabilities

mod_cluster: Buffer overflow in mod_manager when sending request with long JVMRoute

mod_cluster: JavaScript code injection is possible via MCMP mod_manager messages

mod_cluster registers and exposes the root context of a server by default, despite ROOT being in the excluded-contexts list