{"id":"CVE-2024-10306","revision":"14392abc2d064a9bb97f7193865c56b9","records":[{"revision":"14392abc2d064a9bb97f7193865c56b9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-10306","aliases":[],"title":"Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests","description":"A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.","state":0,"publishedAt":"2025-04-23T09:59:49.15+00:00","modifiedAt":"2026-10-21T16:53:50.488+00:00","affected":[{"ecosystem":"https://github.com/modcluster/mod_proxy_cluster","name":"mod_proxy_cluster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"1.3.17\",\n                            \"lessThan\": \"1.3.21.Final\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"packageName\": \"mod_proxy_cluster\",\n                    \"collectionURL\": \"https://github.com/modcluster/mod_proxy_cluster\",\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"mod_proxy_cluster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"mod_proxy_cluster\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.3.21-1.el10\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:10.0\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"mod_proxy_cluster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 10\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"mod_proxy_cluster\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.3.22-1.el10_0.2\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/o:redhat:enterprise_linux:10.0\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"mod_proxy_cluster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"mod_proxy_cluster\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.3.22-1.el9_5.2\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9::appstream\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"mod_proxy_cluster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"mod_proxy_cluster\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.3.22-1.el9_6.1\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:enterprise_linux:9::appstream\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"mod_proxy_cluster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Enterprise Linux 9.4 Extended Update Support\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"mod_proxy_cluster\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:1.3.22-1.el9_4.1\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:rhel_eus:9.4::appstream\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"mod_proxy_cluster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Core Services 2.4.62\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageName\": \"mod_proxy_cluster\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_core_services:1.0\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","name":"jbcs-httpd24-mod_proxy_cluster","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat JBoss Core Services\",\n                    \"collectionURL\": \"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html\",\n                    \"packageName\": \"jbcs-httpd24-mod_proxy_cluster\",\n                    \"defaultStatus\": \"affected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:jboss_core_services:1\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://access.redhat.com/errata/RHBA-2025:2973","https://access.redhat.com/errata/RHBA-2025:5309","https://access.redhat.com/errata/RHSA-2025:3453","https://access.redhat.com/errata/RHSA-2025:9434","https://access.redhat.com/errata/RHSA-2025:9466","https://access.redhat.com/errata/RHSA-2025:9997","https://access.redhat.com/security/cve/CVE-2024-10306","https://bugzilla.redhat.com/show_bug.cgi?id=2321302","https://github.com/modcluster/mod_proxy_cluster/pull/309"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-10306","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-10306","identifiers":["CVE-2024-10306"]},"retained":false,"historicalAffected":[]}],"coverage":[]}