← Zuruck zu CVEs

CVE-2021-40438

CRITICALCISA KEV

9.0

Beschreibung

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE Details

CVSS v3.1 Bewertung9.0

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatHIGH

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht9/16/2021

Zuletzt geandert10/27/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerApache

ProduktApache

SchwachstellennameApache HTTP Server-Side Request Forgery (SSRF)

KEV Aufnahmedatum2021-12-01

Behebungsfrist2021-12-15

Ransomware-NutzungUnknown

Betroffene Produkte

apache:http_serverbroadcom:brocade_fabric_operating_system_firmwaredebian:debian_linuxf5:f5osfedoraproject:fedoranetapp:cloud_backupnetapp:clustered_data_ontapnetapp:storagegridoracle:enterprise_manager_ops_centeroracle:http_serveroracle:instantis_enterprisetrackoracle:secure_global_desktoporacle:zfs_storage_appliance_kitredhat:enterprise_linuxredhat:enterprise_linux_eusredhat:enterprise_linux_for_arm_64redhat:enterprise_linux_for_arm_64_eusredhat:enterprise_linux_for_ibm_z_systemsredhat:enterprise_linux_for_ibm_z_systems_eusredhat:enterprise_linux_for_ibm_z_systems_eus_s390xredhat:enterprise_linux_for_power_big_endianredhat:enterprise_linux_for_power_little_endianredhat:enterprise_linux_for_power_little_endian_eusredhat:enterprise_linux_for_scientific_computingredhat:enterprise_linux_serverredhat:enterprise_linux_server_ausredhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsredhat:enterprise_linux_server_tusredhat:enterprise_linux_server_update_services_for_sap_solutionsredhat:enterprise_linux_server_workstationredhat:enterprise_linux_update_services_for_sap_solutionsredhat:enterprise_linux_workstationredhat:jboss_core_servicesredhat:software_collectionsresf:rocky_linuxsiemens:ruggedcom_nmssiemens:sinec_nmssiemens:sinema_remote_connect_serversiemens:sinema_servertenable:tenable.sc

Schwachen (CWE)

CWE-918CWE-918

Referenzen

https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf(security@apache.org)

https://httpd.apache.org/security/vulnerabilities_24.html(security@apache.org)

https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E(security@apache.org)

https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E(security@apache.org)

https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/(security@apache.org)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/(security@apache.org)

https://security.gentoo.org/glsa/202208-20(security@apache.org)

https://security.netapp.com/advisory/ntap-20211008-0004/(security@apache.org)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ(security@apache.org)

https://www.debian.org/security/2021/dsa-4982(security@apache.org)

https://www.oracle.com/security-alerts/cpuapr2022.html(security@apache.org)

https://www.oracle.com/security-alerts/cpujan2022.html(security@apache.org)

https://www.tenable.com/security/tns-2021-17(security@apache.org)

https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf(af854a3a-2127-422b-91ae-364da2661108)

https://httpd.apache.org/security/vulnerabilities_24.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.httpd.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.httpd.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.httpd.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.httpd.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.httpd.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.httpd.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/202208-20(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20211008-0004/(af854a3a-2127-422b-91ae-364da2661108)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2021/dsa-4982(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpuapr2022.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.oracle.com/security-alerts/cpujan2022.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.tenable.com/security/tns-2021-17(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.