CVE-2024-38477

2024-07-0119:15:05

CWE-476

apache

web.nvd.nist.gov

463

apache

http server

null pointer

mod_proxy

crash

version 2.4.60

security issue

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

48.0%

JSON

null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Affected configurations

Nvd

Vulners

Node

apachehttp_serverRange2.4.0–2.4.60

Node

netappclustered_data_ontapMatch9.0

VendorProductVersionCPE
apachehttp_server*cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
netappclustered_data_ontap9.0cpe:2.3:o:netapp:clustered_data_ontap:9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	http_server	*	cpe:2.3:a:apache:http_server::::::::
netapp	clustered_data_ontap	9.0	cpe:2.3:o:netapp:clustered_data_ontap:9.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.4.59",
        "status": "affected",
        "version": "2.4.0",
        "versionType": "semver"
      }
    ]
  }
]