Critical · published September 16, 2021
CVSS calls it critical at 9.0. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 A single crafted request can redirect traffic to an attacker's chosen server, making this a critical vulnerability in Apache HTTP Server! 🔥 Think of mod_proxy as a delivery service that blindly forwards packages without checking the address. If someone slips in a fake address, the delivery could end up in the wrong hands – or worse, the hands of a malicious attacker! An attacker could exploit this vulnerability to redirect sensitive traffic, potentially leading to data theft or unauthorized access. Imagine your private information being sent to a complete stranger instead of its intended destination — absolutely devastating!
Think of mod_proxy as a delivery service that blindly forwards packages without checking the address. If someone slips in a fake address, the delivery could end up in the wrong hands – or worse, the hands of a malicious attacker! This vulnerability allows a remote user to manipulate the request URI path, causing mod_proxy to forward requests to an arbitrary origin server. This flaw affects Apache HTTP Server versions 2.4.48 and earlier.
An attacker could exploit this vulnerability to redirect sensitive traffic, potentially leading to data theft or unauthorized access. Imagine your private information being sent to a complete stranger instead of its intended destination — absolutely devastating! Immediate action is required: upgrade to Apache HTTP Server version 2.4.49 or later. Additionally, review your server configurations to ensure that mod_proxy is not exposing sensitive endpoints. Don't wait – secure your servers now! You can tackle this! Follow these steps, and you'll have your servers protected in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| resf/rocky_linux | all versions | — |
| redhat/enterprise_linux | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_eus | all versions | — |
| redhat/enterprise_linux_for_arm_64 | all versions | — |
| redhat/enterprise_linux_for_arm_64_eus | all versions | — |
| redhat/enterprise_linux_for_arm_64_eus | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems_eus | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems_eus | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems_eus | all versions | — |
| redhat/enterprise_linux_for_ibm_z_systems_eus_s390x | all versions | — |
| redhat/enterprise_linux_for_power_big_endian | all versions | — |
| redhat/enterprise_linux_for_power_little_endian | all versions | — |
| redhat/enterprise_linux_for_power_little_endian | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_for_power_little_endian_eus | all versions | — |
| redhat/enterprise_linux_for_scientific_computing | all versions | — |
| redhat/enterprise_linux_server | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_aus | all versions | — |
| redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_tus | all versions | — |
| redhat/enterprise_linux_server_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_server_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_update_services_for_sap_solutions | all versions | — |
| redhat/enterprise_linux_workstation | all versions | — |
| redhat/jboss_core_services | all versions | — |
| redhat/software_collections | all versions | — |
| apache/http_server | ≤ 2.4.48 | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/cloud_backup | all versions | — |
| netapp/clustered_data_ontap | all versions | — |
| netapp/storagegrid | all versions | — |
| broadcom/brocade_fabric_operating_system_firmware | all versions | — |
| f5/f5os | ≥ 1.1.0, ≤ 1.1.4 | — |
| f5/f5os | ≥ 1.2.0, ≤ 1.2.1 | — |
| oracle/enterprise_manager_ops_center | all versions | — |
| oracle/http_server | all versions | — |
| oracle/http_server | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/instantis_enterprisetrack | all versions | — |
| oracle/secure_global_desktop | all versions | — |
| oracle/zfs_storage_appliance_kit | all versions | — |
| siemens/ruggedcom_nms | all versions | — |
| siemens/sinec_nms | < 1.0.3 | 1.0.3 |
| siemens/sinema_remote_connect_server | < 3.1 | 3.1 |
| siemens/sinema_remote_connect_server | all versions | — |
| siemens/sinema_server | all versions | — |
| tenable/tenable.sc | ≤ 5.19.1 | — |