Vulnerabilities > CVE-2021-40438 - Server-Side Request Forgery (SSRF) vulnerability in multiple products

CVSS 9.0 - CRITICAL

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

high complexity

critical

NVD

Published: 2021-09-16

Updated: 2023-11-07

Summary

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Http Server - Apache Http Server 0.8.11 Apache Http Server 0.8.14 Apache Http Server 1.0 Apache Http Server 1.0.2 Apache Http Server 1.0.3 Apache Http Server 1.0.5 Apache Http Server 1.1 Apache Http Server 1.1.1 Apache Http Server 1.2 Apache Http Server 1.2.0 Apache Http Server 1.2.1 Apache Http Server 1.2.2 Apache Http Server 1.2.4 Apache Http Server 1.2.5 Apache Http Server 1.2.6 Apache Http Server 1.2.9 Apache Http Server 1.3 Apache Http Server 1.3.0 Apache Http Server 1.3.1 Apache Http Server 1.3.1.1 Apache Http Server 1.3.2 Apache Http Server 1.3.3 Apache Http Server 1.3.4 Apache Http Server 1.3.5 Apache Http Server 1.3.6 Apache Http Server 1.3.7 Apache Http Server 1.3.8 Apache Http Server 1.3.9 Apache Http Server 1.3.10 Apache Http Server 1.3.11 Apache Http Server 1.3.12 Apache Http Server 1.3.13 Apache Http Server 1.3.14 Apache Http Server 1.3.15 Apache Http Server 1.3.16 Apache Http Server 1.3.17 Apache Http Server 1.3.18 Apache Http Server 1.3.19 Apache Http Server 1.3.20 Apache Http Server 1.3.22 Apache Http Server 1.3.23 Apache Http Server 1.3.24 Apache Http Server 1.3.25 Apache Http Server 1.3.26 Apache Http Server 1.3.27 Apache Http Server 1.3.28 Apache Http Server 1.3.29 Apache Http Server 1.3.30 Apache Http Server 1.3.31 Apache Http Server 1.3.32 Apache Http Server 1.3.33 Apache Http Server 1.3.34 Apache Http Server 1.3.35 Apache Http Server 1.3.36 Apache Http Server 1.3.37 Apache Http Server 1.3.38 Apache Http Server 1.3.39 Apache Http Server 1.3.41 Apache Http Server 1.3.42 Apache Http Server 1.3.65 Apache Http Server 1.3.68 Apache Http Server 1.4.0 Apache Http Server 1.15.17 Apache Http Server 1.99 Apache Http Server 2.0 Apache Http Server 2.0.0 Apache Http Server 2.0.1 Apache Http Server 2.0.2 Apache Http Server 2.0.3 Apache Http Server 2.0.4 Apache Http Server 2.0.5 Apache Http Server 2.0.6 Apache Http Server 2.0.7 Apache Http Server 2.0.8 Apache Http Server 2.0.9 Apache Http Server 2.0.10 Apache Http Server 2.0.11 Apache Http Server 2.0.12 Apache Http Server 2.0.13 Apache Http Server 2.0.14 Apache Http Server 2.0.15 Apache Http Server 2.0.16 Apache Http Server 2.0.17 Apache Http Server 2.0.18 Apache Http Server 2.0.19 Apache Http Server 2.0.20 Apache Http Server 2.0.21 Apache Http Server 2.0.22 Apache Http Server 2.0.23 Apache Http Server 2.0.24 Apache Http Server 2.0.25 Apache Http Server 2.0.26 Apache Http Server 2.0.27 Apache Http Server 2.0.28 Apache Http Server 2.0.29 Apache Http Server 2.0.30 Apache Http Server 2.0.31 Apache Http Server 2.0.32 Apache Http Server 2.0.33 Apache Http Server 2.0.34 Apache Http Server 2.0.35 Apache Http Server 2.0.36 Apache Http Server 2.0.37 Apache Http Server 2.0.38 Apache Http Server 2.0.39 Apache Http Server 2.0.40 Apache Http Server 2.0.41 Apache Http Server 2.0.42 Apache Http Server 2.0.43 Apache Http Server 2.0.44 Apache Http Server 2.0.45 Apache Http Server 2.0.46 Apache Http Server 2.0.47 Apache Http Server 2.0.48 Apache Http Server 2.0.49 Apache Http Server 2.0.50 Apache Http Server 2.0.51 Apache Http Server 2.0.52 Apache Http Server 2.0.53 Apache Http Server 2.0.54 Apache Http Server 2.0.55 Apache Http Server 2.0.56 Apache Http Server 2.0.57 Apache Http Server 2.0.58 Apache Http Server 2.0.59 Apache Http Server 2.0.60 Apache Http Server 2.0.61 Apache Http Server 2.0.62 Apache Http Server 2.0.63 Apache Http Server 2.0.64 Apache Http Server 2.0.65 Apache Http Server 2.1 Apache Http Server 2.1.0 Apache Http Server 2.1.1 Apache Http Server 2.1.2 Apache Http Server 2.1.3 Apache Http Server 2.1.4 Apache Http Server 2.1.5 Apache Http Server 2.1.6 Apache Http Server 2.1.7 Apache Http Server 2.1.8 Apache Http Server 2.1.9 Apache Http Server 2.1.10 Apache Http Server 2.2 Apache Http Server 2.2.0 Apache Http Server 2.2.1 Apache Http Server 2.2.2 Apache Http Server 2.2.3 Apache Http Server 2.2.4 Apache Http Server 2.2.5 Apache Http Server 2.2.6 Apache Http Server 2.2.7 Apache Http Server 2.2.8 Apache Http Server 2.2.9 Apache Http Server 2.2.10 Apache Http Server 2.2.11 Apache Http Server 2.2.12 Apache Http Server 2.2.13 Apache Http Server 2.2.14 Apache Http Server 2.2.15 Apache Http Server 2.2.15-60 Apache Http Server 2.2.16 Apache Http Server 2.2.17 Apache Http Server 2.2.18 Apache Http Server 2.2.19 Apache Http Server 2.2.20 Apache Http Server 2.2.21 Apache Http Server 2.2.22 Apache Http Server 2.2.23 Apache Http Server 2.2.24 Apache Http Server 2.2.25 Apache Http Server 2.2.26 Apache Http Server 2.2.27 Apache Http Server 2.2.28 Apache Http Server 2.2.29 Apache Http Server 2.2.30 Apache Http Server 2.2.31 Apache Http Server 2.2.32 Apache Http Server 2.2.33 Apache Http Server 2.2.34 Apache Http Server 2.3.0 Apache Http Server 2.3.1 Apache Http Server 2.3.2 Apache Http Server 2.3.3 Apache Http Server 2.3.4 Apache Http Server 2.3.5 Apache Http Server 2.3.6 Apache Http Server 2.3.7 Apache Http Server 2.3.8 Apache Http Server 2.3.9 Apache Http Server 2.3.10 Apache Http Server 2.3.11 Apache Http Server 2.3.12 Apache Http Server 2.3.13 Apache Http Server 2.3.14 Apache Http Server 2.3.15 Apache Http Server 2.3.16 Apache Http Server 2.4.0 Apache Http Server 2.4.1 Apache Http Server 2.4.2 Apache Http Server 2.4.3 Apache Http Server 2.4.4 Apache Http Server 2.4.5 Apache Http Server 2.4.6 Apache Http Server 2.4.7 Apache Http Server 2.4.8 Apache Http Server 2.4.9 Apache Http Server 2.4.10 Apache Http Server 2.4.11 Apache Http Server 2.4.12 Apache Http Server 2.4.13 Apache Http Server 2.4.14 Apache Http Server 2.4.15 Apache Http Server 2.4.16 Apache Http Server 2.4.17 Apache Http Server 2.4.18 Apache Http Server 2.4.19 Apache Http Server 2.4.20 Apache Http Server 2.4.21 Apache Http Server 2.4.22 Apache Http Server 2.4.23 Apache Http Server 2.4.24 Apache Http Server 2.4.25 Apache Http Server 2.4.26 Apache Http Server 2.4.27 Apache Http Server 2.4.28 Apache Http Server 2.4.29 Apache Http Server 2.4.30 Apache Http Server 2.4.31 Apache Http Server 2.4.32 Apache Http Server 2.4.33 Apache Http Server 2.4.34 Apache Http Server 2.4.35 Apache Http Server 2.4.36 Apache Http Server 2.4.37 Apache Http Server 2.4.38 Apache Http Server 2.4.39 Apache Http Server 2.4.40 Apache Http Server 2.4.41 Apache Http Server 2.4.42 Apache Http Server 2.4.43 Apache Http Server 2.4.44 Apache Http Server 2.4.45 Apache Http Server 2.4.46 Apache Http Server 2.4.47 Apache Http Server 2.4.48	251
Application	Netapp Netapp Cloud Backup - Netapp Storagegrid - Netapp Clustered Data Ontap -	3
Application	Oracle Oracle Http Server 12.2.1.3.0 Oracle Http Server 12.2.1.4.0 Oracle Instantis Enterprisetrack 17.1 Oracle Instantis Enterprisetrack 17.2 Oracle Instantis Enterprisetrack 17.3 Oracle Enterprise Manager OPS Center 12.4.0.0 Oracle ZFS Storage Appliance KIT 8.8 Oracle Secure Global Desktop 5.6	8
Application	Siemens Siemens Sinema Server 14.0 Siemens Sinec NMS *	2
OS	Fedoraproject Fedoraproject Fedora 34 Fedoraproject Fedora 35	2
OS	Debian Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0	3
OS	F5 F5 F5Os 1.1.0 F5 F5Os 1.1.1 F5 F5Os 1.1.2 F5 F5Os 1.1.3 F5 F5Os 1.1.4 F5 F5Os 1.2.0 F5 F5Os 1.2.1	7

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

Related news

15 million public-facing services vulnerable to CISA KEV flaws (source)

References

CVE is a registered MITRE Corporation trademark and MITRE's CVE website is the authoritative source of CVE content. CWE is a registered MITRE Corporation trademark and MITRE's CWE website is the authoritative source of CWE content.