Vulnerabilities

TI-2021-18535 CVE-2021-42013 · GHSA-m24x-wx9p-jqmh

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

CRITICAL 100KEV

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99964 Published 2021-10-07 No fix listed CWE-22

TI-2021-18417 CVE-2021-41773 · GHSA-29h7-gr57-5f8r

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

CRITICAL 100KEV

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99992 Published 2021-10-05 No fix listed CWE-22

TI-2021-18264 CVE-2021-41524 · GHSA-f29c-hjcq-ww2f

null pointer dereference in h2 fuzzing

MEDIUM 54

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.25804 Published 2021-10-05 Partial fix CWE-476

Vulnerabilities

Filters

Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

null pointer dereference in h2 fuzzing