CVE-2024-38472
Apache HTTP Server on WIndows UNC SSRF
Summary
Apache HTTP Server on WIndows UNC SSRF
Original description
The description as published by the source.
SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content
Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2024-38472 apache2 Fixed in: 2.4.60-r0
References
- advisory github.com
- advisory httpd.apache.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- web openwall.com