CVE-2021-40438

mediumpriority · act · 90OT risk · criticalKEV · exploitedEPSS 1.000 · 100 %ileexploit · PoCDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 11 exploits · PoC

Likely / severe?

100.0% (100th) EPSS

CVSS 6.8 · medium

Is it mine?

150 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2021-12-01remediate by 2021-12-15

required action Apply updates per vendor instructions.

EPSS · scored 2026-10-22

Apache HTTP Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedSINEC NMSsiemens_psirt
Update to V1.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813788/
FixedCisco Firepower Extensible Operating System (FXOS)cisco_csaf
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
FixedSINEC NMScisa_csaf_ot
Update to V1.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109813788/
MitigationSINEC NMSsiemens_psirt
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
MitigationSINEMA Server V14siemens_psirt
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
MitigationSINEC NMScisa_csaf_ot
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
MitigationSINEMA Server V14cisa_csaf_ot
Restrict access to the affected systems, especially to port 443/tcp, to trusted IP addresses only
WorkaroundCisco Firepower Extensible Operating System (FXOS)cisco_csaf
Any workarounds will be documented in the product-specific Cisco bugs, which are identified in the Vulnerable Products ["#vp"] section of this advisory.
No fix plannedSINEMA Server V14siemens_psirt
Currently no fix is planned
No fix plannedSINEMA Server V14cisa_csaf_ot
Currently no fix is planned

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.8–9.8

v2.06.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 8.6 · impact 6.4

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 6

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · CISA US

v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondaryexploitability 2.2 · impact 6

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.19criticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Cisco PSIRT US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-918USprimaryCWE-918USCWE-918USCWE-918US

exploits (11)

Public proof-of-concept and weaponised exploit code.

BabyTeam1024/CVE-2021-40438BabyTeam1024/CVE-2021-40438PoC · poc_in_github
Cappricio-Securities/CVE-2021-40438Apache <= 2.4.48 Mod_Proxy - Server-Side Request ForgeryPoC · poc_in_github
Kashkovsky/CVE-2021-40438Apache forward request CVEPoC · poc_in_github
ericmann/apache-cve-pocDockerized Proof-of-Concept of CVE-2021-40438 in Apache 2.4.48.PoC · poc_in_github
gassara-kys/CVE-2021-40438check CVE-2021-40438PoC · poc_in_github
n0m-d/CVE-2021-40438-POCn0m-d/CVE-2021-40438-POCPoC · poc_in_github

affected products (150)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Apache HTTP Server <2.4.49all versionscert_bundDE
Avaya Aura Application Enablement Servicesall versionscert_bundDEcpe:/a:avaya:aura_application_enablement_services:-
Avaya Aura Communication Managerall versionscert_bundDEcpe:/a:avaya:communication_manager:-
Avaya Aura Experience Portalall versionscert_bundDEcpe:/a:avaya:aura_experience_portal:-
Avaya Aura Session Managerall versionscert_bundDEcpe:/a:avaya:session_manager:-
Avaya Aura System Managerall versionscert_bundDEcpe:/a:avaya:aura_system_manager:-
Avaya Web License Managerall versionscert_bundDEcpe:/a:avaya:web_license_manager:-
Broadcom Brocade Switchall versionscert_bundDEcpe:/h:brocade:switch:-
Cisco Expresswayall versionscert_bundDEcpe:/a:cisco:expressway_software:-
Cisco FXOSall versionscert_bundDEcpe:/o:cisco:fxos:-
Cisco Firepowerall versionscert_bundDEcpe:/a:cisco:firepower:-
Cisco Prime Collaboration Provisioningall versionscert_bundDEcpe:/a:cisco:prime_collaboration:::provisioning
Cisco Prime Infrastructureall versionscert_bundDEcpe:/a:cisco:prime_infrastructure:-
Cisco Security Manager (CSM)all versionscert_bundDEcpe:/a:cisco:security_manager:-
Cisco TelePresenceall versionscert_bundDEcpe:/h:cisco:telepresence:video_communication_server
Cisco Unified Computing System (UCS)all versionscert_bundDEcpe:/h:cisco:unified_computing_system:-
Cisco Wide Area Application Servicesall versionscert_bundDEcpe:/a:cisco:wide_area_application_services:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
F5 BIG-IPall versionscert_bundDEcpe:/a:f5:big-ip:-

showing 20 of 150

advisories (7)

Vendor and ecosystem advisories describing this.

SSA-685781SSA-685781: Multiple Vulnerabilities in Apache HTTP Server Affecting Siemens Products2022-06-14csaf · siemens_psirtDE
Multiple vulnerabilities were identified in the Apache HTTP Server software. These include NULL Pointer Dereferencing, Out-of-bounds Write and Server-Side Request Forgery related vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
WID-SEC-W-2022-0724Apache HTTP Server: Mehrere SchwachstellenDeutsch2021-09-16csaf · cert_bundDE
Ein entfernter Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial of Service Zustand herzustellen.
WID-SEC-W-2024-0186HPE OneView: Mehrere SchwachstellenDeutsch2024-01-23csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in HPE OneView ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, um seine Privilegien zu erweitern oder einen Denial-of-Service-Zustand zu verursachen.
WID-SEC-W-2024-1591Juniper JUNOS: Mehrere SchwachstellenDeutsch2024-07-10csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS ausnutzen, um einen Denial of Service zu verursachen, Informationen offenzulegen, Privilegien zu erweitern und Sicherheitsmechanismen inklusive zu umgehen.
cisco-sa-apache-httpd-2.4.49-VWL69sWQMultiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 20212021-11-24csaf · cisco_csafUS
On September 16, 2021, the Apache Software Foundation disclosed five vulnerabilities affecting the Apache HTTP Server (httpd) 2.4.48 and earlier releases. For a description of these vulnerabilities, see the Apache HTTP Server 2.4.49 section ["https://httpd.apache.org/security/vulnerabilities_24.html#2.4.49"] of the Apache HTTP Server 2.4 vulnerabilities webpage. This advisory will be updated as additional information becomes available.
ICSA-22-167-06Siemens Apache HTTP Server2022-06-14icsa · cisa_csaf_otUS
Multiple vulnerabilities were identified in the Apache HTTP Server software. These include NULL Pointer Dereferencing, Out-of-bounds Write and Server-Side Request Forgery related vulnerabilities. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
BIT-apache-2021-40438mod_proxy SSRF2024-03-06vendor · osvUS
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund siemens_psirt cisco_csaf cisa_csaf_ot osv NVD CVE.org MITRE

published 2021-09-16modified 2026-08-06

related (4,148)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-96655US	—OT critical	0.46% (39th)	KEV	2026-09-23
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
CVE-2026-96652US	—OT critical	0.46% (39th)	KEV	2026-09-23
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the…
CVE-2026-83548US	—OT critical	8.04% (95th)	KEV	2026-09-01
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could pot…
CVE-2026-64849US	—OT critical	10.0% (96th)	KEV	2026-08-17
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/…
CVE-2026-15410US	—OT critical	11.8% (96th)	KEV	2026-07-14
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific…

+4143 more

references (102)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan