Yüksek CVSS 7.5
CVE-2024-38472: Http Server: sunucu taraflı istek sahteciliği (SSRF)
Açıklama (NVD)
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
Özet bilgiler
- Ürün
- Apache Http Server
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- %69,47 (yüzdelik 99)
- CWE
- CWE-918
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| apache-http-server | 2.4.0 | — | 2.4.60 |
| netapp-ontap | 9 | 9 | — |