CVE-2024-38472 — Vulnerability intelligence

apache — http server

Published: 2024-07-01T18:12:27.616Z

CVSS

7.5

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

Sources

• CVE-2024-38472
• Vendor Advisory
• Third Party Advisory
• CVE-2024-38472