IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
7.5Yüksek

CVE-2024-38472Apache HTTP Server on WIndows UNC SSRF

Apache Software Foundation Apache HTTP Server; apache_software_foundation apache_http_server Yayım: (2 yıl önce)

Açıklama

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

Zayıflık türü (CWE): CWE-918

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Apache Software Foundation Apache HTTP Server 2.4.0 – ≤ 2.4.59
apache http server 2.4.0 – < 2.4.60
apache_software_foundation apache_http_server < 2.4.60
netapp ontap 9

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (2)
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* ≥ 2.4.0 < 2.4.60
  • cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*

Aynı üründe son açıklar — Apache HTTP Server

7.5Yüksek
CVE-2026-63686

Apache HTTP Server: mod_xml2enc crash on charset conversion failure

Apache Software Foundation Apache HTTP Server

A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds…

8.8Yüksek
CVE-2026-93546

Apache HTTP Server: mod_dav_fs namespace overflow

Apache Software Foundation Apache HTTP Server

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.

5.3Orta
CVE-2026-79768

Apache HTTP Server: mod_userdir information disclosure

Apache Software Foundation Apache HTTP Server

Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir) This issue…