A limited cross-site scripting vulnerability exists in Apache HTTP Server versions 2.4.0 to 2.4.39 affecting the mod_proxy error page. An attacker can cause the error page's link to be malformed and redirect users to an attacker-controlled page. This vulnerability is only exploitable on servers with proxying enabled and misconfigured to display the Proxy Error page. The issue is documented under Ubuntu advisories for multiple Ubuntu LTS releases, with no known exploits in the wild. No explicit patch information is provided in the input data.

Successful exploitation could lead to limited cross-site scripting attacks where users viewing the mod_proxy error page may be redirected to attacker-controlled sites. This could result in information disclosure or user redirection but does not impact server availability or integrity. The vulnerability requires specific server proxy configuration and error page display, limiting its scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, administrators should review proxy configurations to avoid misconfigurations that cause the Proxy Error page to be displayed. Applying updates from the respective Linux distribution vendors (Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS) when available is recommended.