Paper/Archive/CVE-2024-38476

CVE-2024-38476

Apache Software Foundation Apache HTTP Server — Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

EPSS 42%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 98.7.987 × 2019.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Affected

ProductAffectedFixed inSource

Apache HTTP Server2.4.0 – 2.4.59–CNA

http_server≤ 2.4.59–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryhttpd.apache.org/security/vulnerabilities_24.html refsecurity.netapp.com/advisory/ntap-20240712-0001 refopenwall.com/lists/oss-security/2024/07/01/9 refseclists.org/fulldisclosure/2024/Oct/11