Vulnerabilities > CVE-2024-40898 - Server-Side Request Forgery (SSRF) vulnerability in Apache Http Server

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

apache

CWE-918

NVD

Published: 2024-07-18

Updated: 2024-08-08

Summary

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Http Server - Apache Http Server 0.8.11 Apache Http Server 0.8.14 Apache Http Server 1.0 Apache Http Server 1.0.2 Apache Http Server 1.0.3 Apache Http Server 1.0.5 Apache Http Server 1.1 Apache Http Server 1.1.1 Apache Http Server 1.2 Apache Http Server 1.2.0 Apache Http Server 1.2.1 Apache Http Server 1.2.2 Apache Http Server 1.2.4 Apache Http Server 1.2.5 Apache Http Server 1.2.6 Apache Http Server 1.2.9 Apache Http Server 1.3 Apache Http Server 1.3.0 Apache Http Server 1.3.1 Apache Http Server 1.3.1.1 Apache Http Server 1.3.2 Apache Http Server 1.3.3 Apache Http Server 1.3.4 Apache Http Server 1.3.5 Apache Http Server 1.3.6 Apache Http Server 1.3.7 Apache Http Server 1.3.8 Apache Http Server 1.3.9 Apache Http Server 1.3.10 Apache Http Server 1.3.11 Apache Http Server 1.3.12 Apache Http Server 1.3.13 Apache Http Server 1.3.14 Apache Http Server 1.3.15 Apache Http Server 1.3.16 Apache Http Server 1.3.17 Apache Http Server 1.3.18 Apache Http Server 1.3.19 Apache Http Server 1.3.20 Apache Http Server 1.3.22 Apache Http Server 1.3.23 Apache Http Server 1.3.24 Apache Http Server 1.3.25 Apache Http Server 1.3.26 Apache Http Server 1.3.27 Apache Http Server 1.3.28 Apache Http Server 1.3.29 Apache Http Server 1.3.30 Apache Http Server 1.3.31 Apache Http Server 1.3.32 Apache Http Server 1.3.33 Apache Http Server 1.3.34 Apache Http Server 1.3.35 Apache Http Server 1.3.36 Apache Http Server 1.3.37 Apache Http Server 1.3.38 Apache Http Server 1.3.39 Apache Http Server 1.3.41 Apache Http Server 1.3.42 Apache Http Server 1.3.65 Apache Http Server 1.3.68 Apache Http Server 1.4.0 Apache Http Server 1.15.17 Apache Http Server 1.99 Apache Http Server 2.0 Apache Http Server 2.0.0 Apache Http Server 2.0.1 Apache Http Server 2.0.2 Apache Http Server 2.0.3 Apache Http Server 2.0.4 Apache Http Server 2.0.5 Apache Http Server 2.0.6 Apache Http Server 2.0.7 Apache Http Server 2.0.8 Apache Http Server 2.0.9 Apache Http Server 2.0.10 Apache Http Server 2.0.11 Apache Http Server 2.0.12 Apache Http Server 2.0.13 Apache Http Server 2.0.14 Apache Http Server 2.0.15 Apache Http Server 2.0.16 Apache Http Server 2.0.17 Apache Http Server 2.0.18 Apache Http Server 2.0.19 Apache Http Server 2.0.20 Apache Http Server 2.0.21 Apache Http Server 2.0.22 Apache Http Server 2.0.23 Apache Http Server 2.0.24 Apache Http Server 2.0.25 Apache Http Server 2.0.26 Apache Http Server 2.0.27 Apache Http Server 2.0.28 Apache Http Server 2.0.29 Apache Http Server 2.0.30 Apache Http Server 2.0.31 Apache Http Server 2.0.32 Apache Http Server 2.0.33 Apache Http Server 2.0.34 Apache Http Server 2.0.35 Apache Http Server 2.0.36 Apache Http Server 2.0.37 Apache Http Server 2.0.38 Apache Http Server 2.0.39 Apache Http Server 2.0.40 Apache Http Server 2.0.41 Apache Http Server 2.0.42 Apache Http Server 2.0.43 Apache Http Server 2.0.44 Apache Http Server 2.0.45 Apache Http Server 2.0.46 Apache Http Server 2.0.47 Apache Http Server 2.0.48 Apache Http Server 2.0.49 Apache Http Server 2.0.50 Apache Http Server 2.0.51 Apache Http Server 2.0.52 Apache Http Server 2.0.53 Apache Http Server 2.0.54 Apache Http Server 2.0.55 Apache Http Server 2.0.56 Apache Http Server 2.0.57 Apache Http Server 2.0.58 Apache Http Server 2.0.59 Apache Http Server 2.0.60 Apache Http Server 2.0.61 Apache Http Server 2.0.62 Apache Http Server 2.0.63 Apache Http Server 2.0.64 Apache Http Server 2.0.65 Apache Http Server 2.1 Apache Http Server 2.1.0 Apache Http Server 2.1.1 Apache Http Server 2.1.2 Apache Http Server 2.1.3 Apache Http Server 2.1.4 Apache Http Server 2.1.5 Apache Http Server 2.1.6 Apache Http Server 2.1.7 Apache Http Server 2.1.8 Apache Http Server 2.1.9 Apache Http Server 2.1.10 Apache Http Server 2.2 Apache Http Server 2.2.0 Apache Http Server 2.2.1 Apache Http Server 2.2.2 Apache Http Server 2.2.3 Apache Http Server 2.2.4 Apache Http Server 2.2.5 Apache Http Server 2.2.6 Apache Http Server 2.2.7 Apache Http Server 2.2.8 Apache Http Server 2.2.9 Apache Http Server 2.2.10 Apache Http Server 2.2.11 Apache Http Server 2.2.12 Apache Http Server 2.2.13 Apache Http Server 2.2.14 Apache Http Server 2.2.15 Apache Http Server 2.2.15-60 Apache Http Server 2.2.16 Apache Http Server 2.2.17 Apache Http Server 2.2.18 Apache Http Server 2.2.19 Apache Http Server 2.2.20 Apache Http Server 2.2.21 Apache Http Server 2.2.22 Apache Http Server 2.2.23 Apache Http Server 2.2.24 Apache Http Server 2.2.25 Apache Http Server 2.2.26 Apache Http Server 2.2.27 Apache Http Server 2.2.28 Apache Http Server 2.2.29 Apache Http Server 2.2.30 Apache Http Server 2.2.31 Apache Http Server 2.2.32 Apache Http Server 2.2.33 Apache Http Server 2.2.34 Apache Http Server 2.3.0 Apache Http Server 2.3.1 Apache Http Server 2.3.2 Apache Http Server 2.3.3 Apache Http Server 2.3.4 Apache Http Server 2.3.5 Apache Http Server 2.3.6 Apache Http Server 2.3.7 Apache Http Server 2.3.8 Apache Http Server 2.3.9 Apache Http Server 2.3.10 Apache Http Server 2.3.11 Apache Http Server 2.3.12 Apache Http Server 2.3.13 Apache Http Server 2.3.14 Apache Http Server 2.3.15 Apache Http Server 2.3.16 Apache Http Server 2.4.0 Apache Http Server 2.4.1 Apache Http Server 2.4.2 Apache Http Server 2.4.3 Apache Http Server 2.4.4 Apache Http Server 2.4.5 Apache Http Server 2.4.6 Apache Http Server 2.4.7 Apache Http Server 2.4.8 Apache Http Server 2.4.9 Apache Http Server 2.4.10 Apache Http Server 2.4.11 Apache Http Server 2.4.12 Apache Http Server 2.4.13 Apache Http Server 2.4.14 Apache Http Server 2.4.15 Apache Http Server 2.4.16 Apache Http Server 2.4.17 Apache Http Server 2.4.18 Apache Http Server 2.4.19 Apache Http Server 2.4.20 Apache Http Server 2.4.21 Apache Http Server 2.4.22 Apache Http Server 2.4.23 Apache Http Server 2.4.24 Apache Http Server 2.4.25 Apache Http Server 2.4.26 Apache Http Server 2.4.27 Apache Http Server 2.4.28 Apache Http Server 2.4.29 Apache Http Server 2.4.30 Apache Http Server 2.4.31 Apache Http Server 2.4.32 Apache Http Server 2.4.33 Apache Http Server 2.4.34 Apache Http Server 2.4.35 Apache Http Server 2.4.36 Apache Http Server 2.4.37 Apache Http Server 2.4.38 Apache Http Server 2.4.39 Apache Http Server 2.4.40 Apache Http Server 2.4.41 Apache Http Server 2.4.42 Apache Http Server 2.4.43 Apache Http Server 2.4.44 Apache Http Server 2.4.45 Apache Http Server 2.4.46 Apache Http Server 2.4.47 Apache Http Server 2.4.48 Apache Http Server 2.4.49 Apache Http Server 2.4.50 Apache Http Server 2.4.51 Apache Http Server 2.4.52 Apache Http Server 2.4.53 Apache Http Server 2.4.54 Apache Http Server 2.4.55 Apache Http Server 2.4.56 Apache Http Server 2.4.57 Apache Http Server 2.4.58 Apache Http Server 2.4.59 Apache Http Server 2.4.60 Apache Http Server 2.4.61	264
OS	Microsoft Microsoft Windows -	1

Common Weakness Enumeration (CWE)

CWE-918 - Server-Side Request Forgery (SSRF)

References

https://httpd.apache.org/security/vulnerabilities_24.html