PT-2024-5185 · Apache+6 · Apache Http Server+6

Published 2024-07-09 · Updated 2026-03-07 · CVE-2024-40725

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.61

Description: The issue is related to the core of Apache HTTP Server, where a partial fix ignores some use of the legacy content-type based configuration of handlers. This can result in source code disclosure of local content under certain circumstances, such as when files are requested indirectly. For example, PHP scripts may be served instead of interpreted.

Recommendations: Upgrade to version 2.4.62, which fixes this issue.

Exploit

Fix

Improper Access Control

SSRF

Incorrect Privilege Assignment

Information Disclosure

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-284

CWE-918

CWE-266

CWE-200

CWE-668

Related Identifiers

ALT-PU-2024-11994

ALT-PU-2024-11996

AZL-43414

AZL-43427

BDU:2024-05368

BDU:2024-05741

BIT-APACHE-2024-40725

CVE-2024-40725

MGASA-2024-0272

OESA-2024-2288

OPENSUSE-SU-2024:14245-1

OPENSUSE-SU-2024_3742-1

OPENSUSE-SU-2024_3864-1

SUSE-SU-2024:3742-1

SUSE-SU-2024:3750-1

SUSE-SU-2024:3864-1

SUSE-SU-2024_3742-1

SUSE-SU-2024_3750-1

SUSE-SU-2024_3864-1

SUSE-SU-2025:02241-1

SUSE-SU-2025_02241-1

USN-6902-1

Affected Products

Alt Linux

Apache Http Server

Astra Linux

Linuxmint

Red Os

Suse

Ubuntu

References · 74

• 🔥 https://github.com/TAM-K592/CVE-2024-40725-CVE-2024-40898 · Exploit
• 🔥 https://github.com/TAM-K592/CVE-2024-40725-CVE-2024-40898/blob/ALOK/CVE-2024-40725.py · Exploit
• 🔥 https://github.com/soltanali0/CVE-2024-40725 · Exploit
• https://ubuntu.com/security/notices/USN-6902-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3742-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6902-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2024-40725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40725 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-40725 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-40725 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05368 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:3750-1 · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0272 · Vendor Advisory