CVE-2024-38475

9.1 CRITICAL CISA KEV - Actively Exploited
Published: July 01, 2024 Modified: November 17, 2025
View on NVD

Description

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.html
Source: security@apache.org
Vendor Advisory
https://security.netapp.com/advisory/ntap-20240712-0001/
Source: security@apache.org
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/07/01/8
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cf
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
https://httpd.apache.org/security/vulnerabilities_24.html
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240712-0001/
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party Advisory US Government Resource

9 reference(s) from NVD

Quick Stats

CVSS v3 Score
9.1 / 10.0
EPSS (Exploit Probability)
93.9%
100th percentile
Exploitation Status
Actively Exploited
Remediation due: 2025-05-22

Weaknesses (CWE)

CWE-116

Affected Vendors

apache sonicwall netapp

Related CVEs

CVE-2025-52691 10.0
CVE-2025-15168 7.3
CVE-2025-15167 7.3
CVE-2025-15166 7.3
CVE-2025-15165 7.3