CVE-2024-24795

Advisory lineage Upstream: 0 Downstream: 19
Analyzed
Published: 04 Apr 2024, 19:20
Last modified:12 Nov 2024, 19:48

Vulnerability Summary

Overall Risk (default)
medium
25/100
CVSS Score
6.3 MEDIUM
v3.1 (cve.org)
EPSS Score
1.12% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Apr 2024, 19:20
Published
Vulnerability first disclosed
12 Nov 2024, 19:48
Last Modified
Vulnerability information updated

Description

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

EPSS Trends

Current EPSS score: 1.12%• Percentile: 79%

Techniques & Countermeasures

  • CWE-113•Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

    The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

  • CWE-444•Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected Systems

  • apache software foundation•apache http server

    ≥ 2.4.0, ≤ 2.4.58

  • Unknown•HTTP Server

    ≥ 2.4.0, < 2.4.59

  • Unknown•macOS

    < 14.6

  • broadcom•fabric_operating_system

    na

  • debian•debian_linux

    10.0

  • fedoraproject•fedora

    38 | 39 | 40

  • netapp•ontap

    9

  • netapp•ontap_tools

    10

References (10)