CVE-2024-43394CWE-918

Apache HTTP Server: SSRF on Windows due to UNC paths

High · published July 10, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
69.6
In the wild
Unconfirmed
What it is

Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via

mod_rewrite or apache expressions that pass unvalidated request input.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63.

Note:  The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths.

The server offers limited protection against administrators directing the server to open UNC paths.

Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01272 · 69.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-07-10T16:56Z
EPSS history
Timeline
  • 10 JUL 16:56Z
    Apache HTTP Server: SSRF on Windows due to UNC paths
    cvelistv5