PT-2024-5848 · Apache+10 · Apache Http Server+10
Orange_8361
·
Published
2024-07-01
·
Updated
2026-02-22
·
CVE-2024-38474
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Apache HTTP Server versions 2.4.59 and earlier
Description
The issue is related to a substitution encoding problem in the mod rewrite module of the Apache HTTP Server, allowing an attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL, or disclose the source of scripts meant to be executed as CGI.
Recommendations
For Apache HTTP Server versions 2.4.59 and earlier, upgrade to version 2.4.60, which fixes this issue.
As a temporary workaround, consider specifying the rewrite flag "UnsafeAllow3F" for RewriteRules that capture and substitute unsafely to prevent them from failing.
Fix
Improper Encoding or Escaping of Output
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Apache Http Server
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu