Paper/Archive/CVE-2024-38474

CVE-2024-38474

Apache Software Foundation Apache HTTP Server — Apache HTTP Server weakness with encoded question marks in backreferences

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 84.4.844 × 2016.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

Affected

ProductAffectedFixed inSource

Apache HTTP Server2.4.0 – 2.4.59–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADP8.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisoryhttpd.apache.org/security/vulnerabilities_24.html refsecurity.netapp.com/advisory/ntap-20240712-0001 refopenwall.com/lists/oss-security/2024/07/01/7