CVE-2024-38475 (CNNVD-202407-093)
中文标题:
Apache HTTP Server 安全漏洞
英文标题:
Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.
漏洞描述
中文描述:
Apache HTTP Server是美国阿帕奇（Apache）基金会的一款开源网页服务器。该服务器具有快速、可靠且可通过简单的API进行扩充的特点。 Apache HTTP Server 2.4.59及之前版本存在安全漏洞，该漏洞源于输出转义不当，允许攻击者将URL映射无法通过任何URL直接访问的文件系统位置，从而导致代码执行或源代码泄露。
英文描述:
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server | - | ≤ 2.4.59 | - |
cpe:2.3:a:apache_software_foundation:apache_http_server:*:*:*:*:*:*:*:*
|
| apache | http_server | * | - | - |
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
|
| netapp | ontap_9 | - | - | - |
cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:*
|
| sonicwall | sma_200_firmware | * | - | - |
cpe:2.3:o:sonicwall:sma_200_firmware:*:*:*:*:*:*:*:*
|
| sonicwall | sma_210_firmware | * | - | - |
cpe:2.3:o:sonicwall:sma_210_firmware:*:*:*:*:*:*:*:*
|
| sonicwall | sma_400_firmware | * | - | - |
cpe:2.3:o:sonicwall:sma_400_firmware:*:*:*:*:*:*:*:*
|
| sonicwall | sma_410_firmware | * | - | - |
cpe:2.3:o:sonicwall:sma_410_firmware:*:*:*:*:*:*:*:*
|
| sonicwall | sma_500v_firmware | * | - | - |
cpe:2.3:o:sonicwall:sma_500v_firmware:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
nvd.nist.gov
nvd.nist.gov
nvd.nist.gov
nvd.nist.gov
nvd.nist.gov
CVSS评分详情
3.1 (adp)
CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2024-38475 |
2025-11-11 15:22:38 | 2025-11-11 07:39:29 |
| NVD | nvd_CVE-2024-38475 |
2025-11-11 14:59:58 | 2025-11-11 07:47:26 |
| CNNVD | cnnvd_CNNVD-202407-093 |
2025-11-11 15:11:58 | 2025-11-11 07:58:56 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202407-093
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 8
- references_count: 2 -> 7
- data_sources: ['cve'] -> ['cve', 'nvd']