This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache HTTP Server fixes 2 vulnerabilities
Apache fixes 2 vulnerabilities in the Apache HTTP Server product with version 2.4.62 [1].
An attacker is allowed to view the source code of certain scripts without authorization. This vulnerability had already been insufficiently fixed in versions 2.4.60 and 2.4.61 [1].
The vulnerability is present in product:
- Apache HTTP; >=2.4.60, <2.4.62;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2024-40725 at cve.org, NVD
- CWE-668 at cwe.mitre.org
The vulnerability was publicly disclosed 18. 7. 2024.
An attacker is allowed to view NTLM hashes without authorization via an SSRF attack. The vulnerability affects only Windows instances with the mod_rewrite module enabled in the server/vhost context [1].
The vulnerability is present in product:
- Apache HTTP; >=2.4.0, <2.4.62;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-40898 at cve.org, NVD
- CWE-918 at cwe.mitre.org
The vulnerability was publicly disclosed 18. 7. 2024.
By CESNET, z.s.p.o. Martin Krajči on 23. 7. 2024.