BIT-apache-2024-38473

vendorUSosv

Apache HTTP Server proxy encoding problem

view advisory published 2024-07-03Licence: per source

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-38473US	—	25.9% (98th)	Exploit	2024-07-01
Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authenticat…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2024/07/01/6DISCUSSION
https://httpd.apache.org/security/vulnerabilities_24.htmlADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2024-38473WEB
https://security.netapp.com/advisory/ntap-20240712-0001/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan