PT-2025-24053 · Apache · Apache Server

Fabian Weber · Published 2025-06-06 · Updated 2025-06-09 · CVE-2025-3322

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Apache Server versions prior to the fixed version

Description An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server. This issue affects the Apache Server, allowing attackers to execute code remotely with high privileges.

Recommendations For Apache Server versions prior to the fixed version, update to the latest version that includes the fix for this issue. As a temporary workaround, consider disabling the use of expression language to prevent remote code execution until a patch is available. Restrict access to the server to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2025-3322

Affected Products

Apache Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-3322 · Security Note
• https://t.me/cvenotify/124880 · Telegram Post
• https://t.me/cvetracker/25596 · Telegram Post
• https://twitter.com/CVEnew/status/1930903191870423311 · Twitter Post
• https://twitter.com/CveFindCom/status/1930907592764600466 · Twitter Post
• https://bbraun.com/productsecurity · Note
• https://t.me/nekaspersky/4458 · Telegram Post