Skip to main content

Improper Encoding or Escaping of Output

CVE-2024-38474

High
9.8/10

Summary

Substitution encoding issue in "mod_rewrite" in Apache HTTP Server allows attackers to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. This vulnerability affects httpd package versions through 2.4.59, 2.5.0-alpha, and 2.5.0-alpha2-ci-test-only. Users are recommended to upgrade to a fixed version, which fixes this issue. Some "RewriteRules" that capture and substitute unsafely will now fail unless a rewrite flag "UnsafeAllow3F" is specified.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-116 - Improper Encoding or Escaping of Output

The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References

Advisory Timeline

  • Published