CVE-2019-10098

Name of the Vulnerable Software and Affected Versions Apache HTTP server versions 2.4.0 through 2.4.39

Description The issue is related to the mod rewrite function in the Apache HTTP server, which can be fooled by encoded newlines and redirect to an unexpected URL within the request URL. This can allow an attacker to gain unauthorized access to confidential information or impact the availability of information using a specially crafted URL request.

Recommendations For Apache HTTP server versions 2.4.0 through 2.4.39, consider updating the mod rewrite configuration to prevent self-referential redirects from being fooled by encoded newlines. As a temporary workaround, restrict access to the mod rewrite module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.