{"schemaVersion":3,"id":"CVE-2024-39884","aliases":["ALPINE-CVE-2024-39884","SUSE-SU-2024:3061-1","UBUNTU-CVE-2024-39884","DEBIAN-CVE-2024-39884"],"status":"published","duplicateOf":null,"title":null,"description":"A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers.   \"AddType\" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.\n\nUsers are recommended to upgrade to version 2.4.61, which fixes this issue.","dates":{"published":"2024-07-04T08:36:49.772Z","modified":"2025-02-13T17:53:19.719Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.2,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":6.4,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":6.4,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":6.4,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.2,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00889,"percentile":0.58679,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00889},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00889,"percentile":0.58679}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00889,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00889,"percentile":0.58679}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"apache software foundation","product":"apache http server","name":"Apache HTTP Server","label":"apache http server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.4.60","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.4.60","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_http_server"},{"vendor":"apache","product":"http_server","name":"http server","label":"http_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.4.60","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.4.60","eol":{"isEol":false,"eolDate":null,"matchMethod":"cpe","cycle":{"name":"2.4","label":"2.4","eolFrom":null,"isLts":false,"isMaintained":true,"latestVersion":"2.4.69"},"product":{"name":"apache-http-server","label":"Apache HTTP Server","category":"server-app"}},"hubHref":"/vendor/apache/http_server"},{"vendor":"alpine","product":"apache2","name":"apache2","label":"apache2","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/apache2","purlType":"apk","versions":[{"text":"< 2.4.61-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.61-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"apache2","name":"apache2","label":"apache2","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/apache2","purlType":"deb","versions":[{"text":"< 2.4.61-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.61-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"apache2","name":"apache2","label":"apache2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/apache2","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 2.4.41-4ubuntu3.19","noFixRecorded":false,"fixedIn":null},{"text":"< 2.4.52-1ubuntu4.10","noFixRecorded":false,"fixedIn":null},{"text":"< 2.4.58-1ubuntu8.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 2.4.41-4ubuntu3.19 | < 2.4.52-1ubuntu4.10 | < 2.4.58-1ubuntu8.2","eol":null,"hubHref":null},{"vendor":"netapp","product":"ontap_tools","name":"ontap tools","label":"ontap_tools","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"10","noFixRecorded":false,"fixedIn":null}],"versionsText":"10","eol":null,"hubHref":"/vendor/netapp/ontap_tools"},{"vendor":"suse","product":"apache2-tls13&distro=SUSE Linux Enterprise Server 12 SP5","name":"apache2-tls13","label":"apache2-tls13&distro=SUSE Linux Enterprise Server 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/apache2-tls13&distro=SUSE Linux Enterprise Server 12 SP5","purlType":"rpm","versions":[{"text":"< 2.4.51-35.60.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.51-35.60.1","eol":null,"hubHref":null},{"vendor":"suse","product":"apache2-tls13&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","name":"apache2-tls13","label":"apache2-tls13&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/apache2-tls13&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","purlType":"rpm","versions":[{"text":"< 2.4.51-35.60.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.51-35.60.1","eol":null,"hubHref":null},{"vendor":"suse","product":"apache2-tls13&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","name":"apache2-tls13","label":"apache2-tls13&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/apache2-tls13&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","purlType":"rpm","versions":[{"text":"< 2.4.51-35.60.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.51-35.60.1","eol":null,"hubHref":null},{"vendor":"suse","product":"apache2&distro=SUSE Linux Enterprise Server 12 SP5","name":"apache2","label":"apache2&distro=SUSE Linux Enterprise Server 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/apache2&distro=SUSE Linux Enterprise Server 12 SP5","purlType":"rpm","versions":[{"text":"< 2.4.51-35.60.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.51-35.60.1","eol":null,"hubHref":null},{"vendor":"suse","product":"apache2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","name":"apache2","label":"apache2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/apache2&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","purlType":"rpm","versions":[{"text":"< 2.4.51-35.60.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.51-35.60.1","eol":null,"hubHref":null},{"vendor":"suse","product":"apache2&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","name":"apache2","label":"apache2&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/apache2&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","purlType":"rpm","versions":[{"text":"< 2.4.51-35.60.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.4.51-35.60.1","eol":null,"hubHref":null}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","label":"httpd.apache.org/security/vulnerabilities_24.html","hostname":"httpd.apache.org","tags":["Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240712-0002/","label":"security.netapp.com/advisory/ntap-20240712-0002/","hostname":"security.netapp.com","tags":["Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/17/6","label":"www.openwall.com/lists/oss-security/2024/07/17/6","hostname":"www.openwall.com","tags":["Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/8","label":"www.openwall.com/lists/oss-security/2024/07/03/8","hostname":"www.openwall.com","tags":["Mailing List"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-39884","label":"security.alpinelinux.org/vuln/CVE-2024-39884","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243061-1/","label":"www.suse.com/support/update/announcement/2024/suse-su-20243061-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1227353","label":"bugzilla.suse.com/1227353","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39884","label":"www.suse.com/security/cve/CVE-2024-39884","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://ubuntu.com/security/CVE-2024-39884","label":"ubuntu.com/security/CVE-2024-39884","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-39884","label":"www.cve.org/CVERecord?id=CVE-2024-39884","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-39884","label":"httpd.apache.org/security/vulnerabilities_24.html","hostname":"httpd.apache.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-6885-1","label":"ubuntu.com/security/notices/USN-6885-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-39884","label":"security-tracker.debian.org/tracker/CVE-2024-39884","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39884","label":"nvd.nist.gov/vuln/detail/CVE-2024-39884","hostname":"nvd.nist.gov","tags":["Oval","Advisory"]}],"lineage":{"upstream":[],"downstream":["MGASA-2024-0258","OPENSUSE-SU-2024:14116-1","SUSE-SU-2024:3172-1","SUSE-SU-2024:3173-1","SUSE-SU-2025:02241-1","SUSE-SU-2026:2686-1","USN-6885-1"],"duplicates":[],"related":["OPENSUSE-SU-2024:14116-1","SUSE-SU-2024:3172-1","SUSE-SU-2024:3173-1","SUSE-SU-2025:02241-1","SUSE-SU-2026:2686-1","USN-6885-1"]},"timeline":[{"kind":"published","date":"2024-07-04T08:36:49.772Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-02-13T17:53:19.719Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T03:39:59.705Z","stale":false,"partial":false}}