SWSandworm Watch
target entity

HTTP Server

4 source-linked records in the current knowledge graph.

high

CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability

Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2024-38475EPSS 100.0%ApacheHTTP Server
CISA KEV ↗ · unattributed attribution
high

CVE-2021-42013: Apache HTTP Server Path Traversal Vulnerability

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773. Required action: Apply updates per vendor instructions.

CVE-2021-41773CVE-2021-42013EPSS 100.0%ApacheHTTP Server
CISA KEV ↗ · unattributed attribution
high

CVE-2021-41773: Apache HTTP Server Path Traversal Vulnerability

Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013. Required action: Apply updates per vendor instructions.

CVE-2021-41773CVE-2021-42013EPSS 100.0%ApacheHTTP Server
CISA KEV ↗ · unattributed attribution
high

CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability

Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard. Required action: Apply updates per vendor instructions.

CVE-2019-0211EPSS 65.0%ApacheHTTP Server
CISA KEV ↗ · unattributed attribution