Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Apache HTTP Server Improper Encoding or Escaping of Output Vulnerability - CVE-2024-38474 - Vulnerability Database
Apache HTTP Server

Apache HTTP Server Improper Encoding or Escaping of Output Vulnerability - CVE-2024-38474

Critical
Reference: CVE-2024-38474
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-38474
Title: Apache HTTP Server Improper Encoding or Escaping of Output Vulnerability
Overview:

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by anyURL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60 which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag quotUnsafeAllow3Fquot is specified.