Apache HTTP Server Multiple Vulnerabilities

Multiple vulnerabilities were identified in Apache HTTP Server. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, remote code execution, security restriction bypass and sensitive information disclosure on the targeted system.

Note:

CVE-2024-38475 is being exploited in the wild. This vulnerability allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Hence, the risk level is rated as High Risk.

Impact

• Denial of Service
• Remote Code Execution
• Security Restriction Bypass
• Information Disclosure

System / Technologies affected

• Apache HTTP Server versions prior to 2.4.60

Solutions

Before installation of the software, please visit the vendor web-site for more details.

Apply fixes issued by the vendor:

• Apache HTTP Server version 2.4.60

Vulnerability Identifier

• CVE-2024-36387
• CVE-2024-38472
• CVE-2024-38473
• CVE-2024-38474
• CVE-2024-38475
• CVE-2024-38476
• CVE-2024-38477
• CVE-2024-39573

Source

• Apache

Related Link

• https://httpd.apache.org/security/vulnerabilities_24.html
• https://www.cisa.gov/news-events/alerts/2025/05/01/cisa-adds-two-known-exploited-vulnerabilities-catalog