CVE-2024-38476

CRITICAL | Platform: macOS | Changelog

CVE Details

Description

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

CVSS 3.1 Score

Metric	Value
Base Score	9.8 (CRITICAL)
Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Weakness

CWE-829

References

Apple Security Advisory
NVD Entry
https://httpd.apache.org/security/vulnerabilities_24.html (Vendor Advisory)
https://security.netapp.com/advisory/ntap-20240712-0001/ (Third Party Advisory)
http://seclists.org/fulldisclosure/2024/Oct/11
http://www.openwall.com/lists/oss-security/2024/07/01/9 (Mailing List, Third Party Advisory)