CVEvulnerability
CVE-2024-38476
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2024-07-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-829
Description
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Affected configurations
• apache http server (>= 2.4.0 < 2.4.60)
• netapp clustered data ontap 9.0
Related
Weakness · CWE (1)
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere weakness
References
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
- https://security.netapp.com/advisory/ntap-20240712-0001/ Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Oct/11 seclists.org
- http://www.openwall.com/lists/oss-security/2024/07/01/9 Mailing List, Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
- https://security.netapp.com/advisory/ntap-20240712-0001/ Third Party Advisory