CVE-2024-38473: apache software foundation apache http server Improper Encoding or Escaping of Output
Vulnerability summary
CVE-2024-38473 is a high (CVSS 8.1) Improper Encoding or Escaping of Output vulnerability in apache software foundation apache http server. EPSS estimates a 25.88% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 14 · Related 8Timeline
- 01-07-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
25.88%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 25.88% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- apache2< 2.4.60-r0
Apache1 product
- http_server≥ 2.4.0, < 2.4.60
Apache software foundation1 product
- apache http server≥ 2.4.0, ≤ 2.4.59
Debian1 product
- apache2< 2.4.61-1~deb12u1 | < 2.4.60-1
Netapp1 product
Ubuntu1 product
- apache2< 2.4.18-2ubuntu3.17+esm17 | < 2.4.29-1ubuntu4.27+esm7 | < 2.4.41-4ubuntu3.19 | < 2.4.52-1ubuntu4.10 | < 2.4.58-1ubuntu8.2
6 vendors · 6 products
References
11 links- security.netapp.com/advisory/ntap-20240712-0001/Third Party Advisory
- www.openwall.com/lists/oss-security/2024/07/01/6Mailing List
