CVE-2019-10098

A vulnerability was discovered in Apache httpd, in mod_rewrite. Certain self-referential mod_rewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw requires the use of certain Rewrite configuration directives. The following command can be used to search for possible vulnerable configurations:

grep -R '^\s*Rewrite' /etc/httpd/

See https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html