CVE-2024-39884: apache software foundation apache http server
Vulnerability summary
CVE-2024-39884 is a medium (CVSS 6.2) vulnerability in apache software foundation apache http server. EPSS estimates a 0.89% chance of exploitation in the next 30 days, higher than 58.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 6Timeline
- 04-07-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · AlpineEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST6.2MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.89%
Chance of exploitation in the next 30 days
Percentile
59%
Versus all other CVEs
30-day change
0.00 pp
From 0.89% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Suse6 products
- apache2-tls13&distro=SUSE Linux Enterprise Server 12 SP5< 2.4.51-35.60.1
- apache2-tls13&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.4.51-35.60.1
- apache2-tls13&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 2.4.51-35.60.1
- apache2&distro=SUSE Linux Enterprise Server 12 SP5< 2.4.51-35.60.1
- apache2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 2.4.51-35.60.1
Alpine1 product
- apache2< 2.4.61-r0
Apache1 product
- http_server2.4.60
Apache software foundation1 product
- apache http server2.4.60
Debian1 product
- apache2< 2.4.61-1
Netapp1 product
Ubuntu1 product
- apache2All versions (No fix recorded) | < 2.4.41-4ubuntu3.19 | < 2.4.52-1ubuntu4.10 | < 2.4.58-1ubuntu8.2
7 vendors · 12 products
References
14 links- httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- security.netapp.com/advisory/ntap-20240712-0002/Third Party Advisory
- www.openwall.com/lists/oss-security/2024/07/17/6Mailing List
- www.openwall.com/lists/oss-security/2024/07/03/8Mailing List
