This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache HTTP Server fixes 8 vulnerabilities
Apache fixes 8 vulnerabilities in the Apache HTTP Server product with version 2.4.60 [1]. The most severe vulnerabilities are described below.
An unauthenticated remote attacker is allowed to cause an SSRF attack in the Windows version of Apache HTTP Server and thereby gain unauthorized access to NTLM hashes [1].
The vulnerability is present in product:
- Apache HTTP; <=2.4.59;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-38472 at cve.org, NVD
- CWE-918 at cwe.mitre.org
The vulnerability was publicly disclosed 1. 7. 2024.
An unauthenticated remote attacker is allowed to execute, or possibly view the source code of, scripts that should not be directly accessible [1].
The vulnerability is present in product:
- Apache HTTP; <=2.4.59;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-38474 at cve.org, NVD
- CWE-116 at cwe.mitre.org
The vulnerability was publicly disclosed 1. 7. 2024.
An unauthenticated remote attacker is allowed to access files that are not meant to be directly accessible without authorization, which may result in code execution or unauthorized access to source code [1].
The vulnerability is present in product:
- Apache HTTP; <=2.4.59;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2024-38475 at cve.org, NVD
- CWE-116 at cwe.mitre.org
The vulnerability was publicly disclosed 1. 7. 2024.
An authenticated local attacker is allowed to access information or run local scripts without authorization by sending requests with specially crafted headers [1].
The vulnerability is present in product:
- Apache HTTP; <=2.4.59;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-38476 at cve.org, NVD
- CWE-829 at cwe.mitre.org
The vulnerability was publicly disclosed 1. 7. 2024.
An unauthenticated remote attacker is allowed to carry out a DoS attack by sending a specially crafted request [1].
The vulnerability is present in product:
- Apache HTTP; <=2.4.59;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-38477 at cve.org, NVD
- CWE-476 at cwe.mitre.org
The vulnerability was publicly disclosed 1. 7. 2024.
By CESNET, z.s.p.o. Martin Krajči on 2. 7. 2024.