⚠ Actively exploited
Added to CISA KEV on 2025-05-01. Federal agencies required to patch by 2025-05-22. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2024-38475 — Improper Encoding or Escaping of Output in Apache Http Server
Severity
9.1CRITICALNVD
EPSS
93.9%
top 0.13%
CISA KEV
KEV
Added 2025-05-01
Due 2025-05-22
Exploit
PoC available
Public exploit / PoC exists
Timeline
PublishedJul 1
KEV addedMay 1
KEV dueMay 22
Latest updateJul 21
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2
Affected Packages7 packages
Patches
🔴Vulnerability Details
7GHSA
▶
💥Exploits & PoCs
1Nuclei▶
Sonicwall - Pre-Authentication Arbitrary File Read
📋Vendor Advisories
7Oracle
▶
🕵️Threat Intelligence
1📄Research Papers
1💬Community
1HackerOne▶
important: Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. (CVE-2024-38475)↗2024-07-13