PT-2021-4294 · Apache +1 · Apache Http Server +1

Published 2021-10-04 · Updated 2025-12-14 · CVE-2021-41773

Positive Technologies · (AI Summary)

CVSS v2.0

9.3

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.49 and 2.4.50 Apache HTTP Server version 2.4.49

Description A path traversal flaw was discovered in Apache HTTP Server 2.4.49. An attacker can exploit this to map URLs to files outside of configured directories. If files outside these directories are not protected by default configurations, requests can succeed. Enabling CGI scripts for these aliased paths could allow for remote code execution. This issue is actively exploited in the wild. The initial fix in version 2.4.50 was incomplete.

Recommendations Upgrade to a version later than 2.4.50.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALSA-2021_3816

ALSA-2022_0891

ALSA-2022_1915

ALT-PU-2021-2994

ALT-PU-2021-3018

ALT-PU-2021-3037

ALT-PU-2021-3060

BDU:2021-04903

BIT-APACHE-2021-41773

CVE-2021-41773

MGASA-2021-0461

OPENSUSE-SU-2024:11560-1

RHSA-2021_3816

RHSA-2021_3856

RHSA-2022_0143

RHSA-2022_0891

RHSA-2022_1915

Affected Products

Alt Linux

Apache Http Server

References · 370

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/apache_normalize_path.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_normalize_path_rce.rb · Exploit
• 🔥 https://github.com/dhmosfunk/CVE-2023-25690-POC · Exploit
• 🔥 https://github.com/blasty/CVE-2021-41773 · Exploit
• 🔥 https://github.com/inbug-team/CVE-2021-41773_CVE-2021-42013 · Exploit
• 🔥 https://github.com/thehackersbrain/CVE-2021-41773 · Exploit
• 🔥 https://github.com/tangxiaofeng7/CVE-2022-22947-Spring-Cloud-Gateway · Exploit
• 🔥 https://github.com/iilegacyyii/PoC-CVE-2021-41773 · Exploit
• 🔥 https://github.com/HightechSec/scarce-apache2 · Exploit
• 🔥 https://github.com/MrCl0wnLab/SimplesApachePathTraversal · Exploit
• 🔥 https://github.com/lorddemon/CVE-2021-41773-PoC · Exploit
• 🔥 https://github.com/Vulnmachines/cve-2021-41773 · Exploit
• 🔥 https://github.com/justakazh/mass_cve-2021-41773 · Exploit
• 🔥 https://github.com/walnutsecurity/cve-2021-42013 · Exploit
• 🔥 https://github.com/htrgouvea/lab-cve-2021-41773 · Exploit