CVE-2024-38474: apache software foundation apache http server Improper Encoding or Escaping of Output
Vulnerability summary
CVE-2024-38474 is a critical (CVSS 9.8) Improper Encoding or Escaping of Output vulnerability in apache software foundation apache http server. EPSS estimates a 2.46% chance of exploitation in the next 30 days, higher than 84.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 22 · Related 11Timeline
- 01-07-2024PublishedVulnerability first disclosed.
- 25-03-2025Last modifiedVulnerability information updated.
Description
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HDiffers
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.46%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.46% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- apache2< 2.4.60-r0
Apache1 product
- http_server≥ 2.4.0, < 2.4.60
Apache software foundation1 product
- apache http server≥ 2.4.0, ≤ 2.4.59
Debian1 product
- apache2< 2.4.61-1~deb12u1 | < 2.4.60-1
Netapp1 product
Ubuntu1 product
- apache2< 2.4.7-1ubuntu4.22+esm10 | < 2.4.18-2ubuntu3.17+esm14 | < 2.4.29-1ubuntu4.27+esm4 | < 2.4.41-4ubuntu3.23 | < 2.4.52-1ubuntu4.16 | < 2.4.58-1ubuntu8.8
6 vendors · 6 products
References
13 links- security.netapp.com/advisory/ntap-20240712-0001/Third Party Advisory
