CVE-2024-39573CWE-20

Apache HTTP Server: mod_rewrite proxy handler substitution

High · published July 1, 2024

CVSS v3.1

7.5

EPSS

37%

Percentile

98.5

In the wild

Unconfirmed

What it is

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.37180 · 98.5th percentile
Weakness: CWE-20 · Improper Input Validation
Published: 2024-07-01T18:16Z

EPSS history

Timeline

01 JUL 18:16Z
Apache HTTP Server: mod_rewrite proxy handler substitution
cvelistv5