Rewterz Threat Advisory – Multiple Apache Products Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2023-45725 CVSS: 9.8

Apache CouchDB could allow a remote attacker to gain elevated privileges on the system, caused by a flaw when using design document functions. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to gain elevated privileges to insert the design documents into the database, then manipulate a user to access a function from that design document.

CVE-2023-6710 CVSS: 3.5

Apache HTTP Server is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the mod_proxy_cluster. A remote authenticated attacker could exploit this vulnerability using the alias parameter in a specially crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

Impact

• Privileges Escalation
• Cross-Site Scripting

Indicators Of Compromise

CVE

• CVE-2023-45725
• CVE-2023-6710

Affected Vendors

Apache

Affected Products

• Apache HTTP Server
• Apache CouchDB 3.3.2

Remediation

Refer to Apache Website for patch, upgrade or suggested workaround information.

CVE-2023-45725

CVE-2023-6710