CVE-2024-38476

CVE Details

Release Date:

2024-07-01

Description

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue.

See more information about CVE-2024-38476 from MITRE CVE dictionary and NIST NVD

CVSS Scoring

NOTE: The following CVSS v3.1 metrics and score provided are preliminary and subject to review.

Base Score:	8.1	CVSS Vector:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack Vector:	Network	Attack Complexity:	Low
Privileges Required:	None	User Interaction:	Required
Scope:	Unchanged	Confidentiality Impact:	High
Integrity Impact:	High	Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (httpd)	ELSA-2024-7101	2024-10-16
Oracle Linux version 8 (httpd)	ELSA-2024-5193	2024-08-13
Oracle Linux version 8 (mod_http2)	ELSA-2024-5193	2024-08-13
Oracle Linux version 8 (mod_md)	ELSA-2024-5193	2024-08-13
Oracle Linux version 9 (httpd)	ELSA-2024-5138	2024-08-08