Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests
Vulnerability Description
A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10306
Credits & Attribution
No credits recorded in the NVD database.
References
- https://access.redhat.com/errata/RHBA-2025:2973
- https://access.redhat.com/errata/RHBA-2025:5309
- https://access.redhat.com/errata/RHSA-2025:9434
- https://access.redhat.com/errata/RHSA-2025:9466
- https://access.redhat.com/errata/RHSA-2025:9997
- https://access.redhat.com/security/cve/CVE-2024-10306
- https://bugzilla.redhat.com/show_bug.cgi?id=2321302
- https://github.com/modcluster/mod_proxy_cluster/pull/309
More from Unknown
View All →Affected Vendor
Unknown
View all reports →