CVE-2024-40898

Description

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Problem types

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Timeline

Credits

Smi1e (DBAPPSecurity Ltd.) 0x400a0c92a0

xiaojunjie (DBAPPSecurity Ltd.) 0x400a0c92b0

References

https://httpd.apache.org/security/vulnerabilities_24.html vendor-advisory

cve.org CVE-2024-40898

nvd.nist.gov CVE-2024-40898

Download JSON