PT-2025-27781 · Apache · Apache Httpd

Published 2025-07-03 · Updated 2025-07-03 · CVE-2025-27452

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache httpd (affected versions not specified)

Description: The configuration of the Apache httpd webserver is partly insecure due to unnecessary activated modules. These modules pose a risk to the webserver, enabling directory listing.

Recommendations: For Apache httpd, consider disabling unnecessary modules to minimize the risk of exploitation. As a temporary workaround, restrict access to the directory listing functionality until a secure configuration is implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-548

Related Identifiers

BDU:2025-11704

CVE-2025-27452

Affected Products

Apache Httpd

References · 10

• https://sick.com/psirt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27452 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27452 · Vendor Advisory
• https://sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11704 · Security Note
• https://sick.com/.well-known/csaf/white/2025/sca-2025-0008.json · Vendor Advisory
• https://first.org/cvss/calculator/3.1 · Note
• https://twitter.com/CVEnew/status/1940738068920913966 · Twitter Post
• https://endress.com · Note
• https://cisa.gov/resources-tools/resources/ics-recommended-practices · Note