Security readout for executives and security teams
Plain-English summary
CVE-2024-10306 is an access-control flaw in mod_proxy_cluster. A configuration pattern using <Directory> may not restrict MCMP management requests as intended, letting a user with network access to the host alter load-balancer node state. Red Hat rates it medium; the host should not be public-facing.
Executive priority
Treat as a targeted infrastructure-hardening issue, not an emergency internet-wide crisis based on current evidence. Prioritize systems where load-balancer management interfaces are reachable by untrusted users or networks.
Technical view
The issue is CWE-863: incorrect authorization. The documented problem is that <Directory> should be replaced by <Location> for MCMP access restrictions, because Require ip may not apply as expected. Unauthorized MCMP requests could add, remove, or update backend nodes, causing limited confidentiality and integrity impact without availability impact in the CVSS vector.
Likely exposure
Exposure is most likely in environments running mod_proxy_cluster on affected Red Hat Enterprise Linux 9, RHEL 10, or Red Hat JBoss Core Services packages, especially where the MCMP management endpoint is reachable beyond trusted administrative networks.
Exploitation context
The CVSS vector requires network access and low privileges, with no user interaction. The source bundle does not indicate CISA KEV listing or active exploitation. Public exposure would increase concern, but Red Hat notes this host should not serve general public traffic.
Researcher notes
Key uncertainty is exact fixed-version mapping across Red Hat streams from the provided bundle. The root cause is configuration-scope mismatch, not a memory corruption issue. Validate effective authorization behavior without publishing offensive request details.
Mitigation direction
- Apply applicable Red Hat updates from the listed RHSA and RHBA advisories.
- Review vendor guidance for affected mod_proxy_cluster and JBoss Core Services packages.
- Replace vulnerable <Directory>-based MCMP restrictions with vendor-recommended <Location>-based controls.
- Restrict MCMP management access to trusted administrative networks only.
- Ensure the management host is not exposed to the public internet.
Validation and detection
- Inventory systems for mod_proxy_cluster and JBoss Core Services packages.
- Compare installed package versions against Red Hat advisories for your platform.
- Review Apache configuration for MCMP access controls using <Directory>.
- Confirm MCMP endpoints are reachable only from trusted networks.
- Check monitoring for unexpected backend node add, remove, or update activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-10306 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N2.82.5redhatVulnerability scoring details
Base CVSS 3.1 score
5.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHBA-2025:2973CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHBA-2025:5309CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9434CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9466CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:9997CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-10306CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2321302CVE reference, redhat · issue-tracking, x_refsource_REDHAT
- https://github.com/modcluster/mod_proxy_cluster/pull/309CVE reference, redhat
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.