Login Request a demo
Critical severity · published Jul 1, 2024
CVE-2024-38475
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
In wildKEV
9.1
CVSS
100%
EPSS
Yes
On KEV
Description
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 1, 2025
Federal remediation dueMay 22, 2025
Ransomware campaign useNot known
Affected products
Which versions
HS
HTTP Server · Apache
2.4.0 through 2.4.59 · source: vendor, NVD, CISA, KEV
O9
Ontap 9 · Netapp
0 · source: NVD, CISA
S2
Sma 200 Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
S2
Sma 210 Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
S4
Sma 400 Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
S4
Sma 410 Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
S5
Sma 500v Firmware · Sonicwall
before 10.2.1.14-75sv · source: NVD
Affected product
HS
HTTP Server
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38475
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38475
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://httpd.apache.org/security/vulnerabilities_24.html
security.netapp.com
https://security.netapp.com/advisory/ntap-20240712-0001/
More from HTTP Server
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)
9.8
CVE-2021-41773
Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
9.0
CVE-2021-40438
mod_proxy SSRF
7.8
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability
9.8
CVE-2026-59797
Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function