CVE-2024-47252: apache software foundation apache http server

Vulnerability summary

CVE-2024-47252 is a high (CVSS 7.5) vulnerability in apache software foundation apache http server. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.5% of scored vulnerabilities.

Timeline

1. 10-07-2025
   PublishedVulnerability first disclosed.
2. 04-11-2025
   Last modifiedVulnerability information updated.

Description

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.

• CWE-150Improper Neutralization of Escape, Meta, or Control SequencesThe product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.