{"id": "CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ", "type": "cisco", "bulletinFamily": "software", "title": "Apache HTTP Server Vulnerabilties: October 2021", "description": "On October 5, 2021 and October 7, 2021, the Apache Software Foundation released two security announcements for the Apache HTTP Server that disclosed the following vulnerabilities:\n CVE-2021-41524: Null Pointer Dereference Vulnerability CVE-2021-41773: Path Traversal and Remote Code Execution Vulnerability CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)\n\nFor descriptions of these vulnerabilities, see the Apache Security Announcement [\"https://httpd.apache.org/security/vulnerabilities_24.html\"]. For additional information, see the Cisco TALOS blog post, Threat Advisory: Apache HTTP Server zero-day vulnerability opens door for attackers [\"https://blog.talosintelligence.com/2021/10/apache-vuln-threat-advisory.html\"].\n\nCisco investigated its product line and concluded that no Cisco products are affected by these vulnerabilities.", "published": "2021-10-07T16:00:00", "modified": "2021-10-07T16:00:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "reporter": "Cisco", "references": ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"], "cvelist": ["CVE-2021-41524", "CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-16T08:27:08", "viewCount": 15, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41524", "RH:CVE-2021-41773"]}, {"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013", "UB:CVE-2021-41524"]}, {"type": "cve", "idList": ["CVE-2021-41524", "CVE-2021-42013", "CVE-2021-41773"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["AL2_ALAS-2021-1716.NASL", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL", "WEB_APPLICATION_SCANNING_113014", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "ALA_ALAS-2021-1543.NASL"]}, {"type": "slackware", "idList": ["SSA-2021-280-01", "SSA-2021-278-01"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF", "FEDORA:9501630AAF04", "FEDORA:00C4C3098596"]}, {"type": "httpd", "idList": ["HTTPD:9BD7C7441A852DCB472C001D2290429F", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C", "HTTPD:E1C40920F9DFC60284EEE7539DA30483"]}, {"type": "amazon", "idList": ["ALAS2-2021-1716", "ALAS-2021-1543"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "exploitdb", "idList": ["EDB-ID:50406", "EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854", "1337DAY-ID-36897"]}, {"type": "threatpost", "idList": ["THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "wallarmlab", "idList": ["WALLARMLAB:6D3FED0879553B4C47AD26ED1DEB5AEB"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}], "modified": "2021-10-16T08:27:08", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-10-16T08:27:08", "rev": 2}, "vulnersScore": 6.3}, "affectedSoftware": [], "vendorCvss": {}}

{"redhatcve": [{"id": "RH:CVE-2021-42013", "hash": "68e0e2fdbd4334e5521685ebb88fe657", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-42013", "description": "A path transversal and remote code execution flaw was found in Apache HTTP Server 2.4.49 and 2.4.50. A remote attacker could use this flaw to map URLs to files outside the expected document root. Additionally, this flaw could leak the source of interpreted files like CGI scripts. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This is an incomplete fix for CVE-2021-41773.\n", "published": "2021-10-07T17:33:09", "modified": "2021-10-16T12:21:33", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-42013", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2011900"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-16T13:27:55", "history": [{"bulletin": {"id": "RH:CVE-2021-42013", "hash": "5f7ebeb1ae7423de6bdf0b9aa65cfa29", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-42013", "description": "No description is available for this CVE.\n", "published": "2021-10-07T17:33:09", "modified": "2021-10-07T17:33:09", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-42013", "reporter": "redhat.com", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=2011900"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-07T19:27:17", "history": [], "viewCount": 11, "enchantments": {}, "objectVersion": "1.6", "vendorCvss": {"score": "8.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, "lastseen": "2021-10-07T19:27:17", "differentElements": ["description", "modified"], "edition": 1}, {"bulletin": {"id": "RH:CVE-2021-42013", "hash": "3f9b1f384561acc58664e33c9b32499d", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-42013", "description": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.\n", "published": "2021-10-07T17:33:09", "modified": "2021-10-07T20:20:23", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-42013", "reporter": "redhat.com", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=2011900"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-07T22:27:19", "history": [], "viewCount": 25, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-07T22:27:19", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-10-07T22:27:19", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "8.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, "lastseen": "2021-10-07T22:27:19", "differentElements": ["modified"], "edition": 2}, {"bulletin": {"id": "RH:CVE-2021-42013", "hash": "d056f25801b2e4438bca4ed7f5a569c3", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-42013", "description": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.\n", "published": "2021-10-07T17:33:09", "modified": "2021-10-08T19:43:53", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-42013", "reporter": "redhat.com", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=2011900"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T22:26:57", "history": [], "viewCount": 29, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-08T22:26:57", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-10-08T22:26:57", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "8.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, "lastseen": "2021-10-08T22:26:57", "differentElements": ["modified", "references"], "edition": 3}, {"bulletin": {"id": "RH:CVE-2021-42013", "hash": "32a31c5356e380d6c4f27e20b94fa826", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-42013", "description": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.\n", "published": "2021-10-07T17:33:09", "modified": "2021-10-12T10:38:36", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-42013", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2011900"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T13:27:32", "history": [], "viewCount": 33, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-08T22:26:57", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-10-08T22:26:57", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "8.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, "lastseen": "2021-10-12T13:27:32", "differentElements": ["cvss", "modified"], "edition": 4}, {"bulletin": {"id": "RH:CVE-2021-42013", "hash": "9f982b4bd001f6398c079b829547a2f7", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-42013", "description": "It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.\n", "published": "2021-10-07T17:33:09", "modified": "2021-10-13T06:24:39", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-42013", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2011900"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T13:27:04", "history": [], "viewCount": 33, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_50.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854", "1337DAY-ID-36897"]}, {"type": "exploitdb", "idList": ["EDB-ID:50406", "EDB-ID:50383"]}, {"type": "threatpost", "idList": ["THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-13T13:27:04", "rev": 2}, "score": {"value": 6.3, "vector": "NONE", "modified": "2021-10-13T13:27:04", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "8.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, "lastseen": "2021-10-13T13:27:04", "differentElements": ["description", "modified"], "edition": 5}, {"bulletin": {"id": "RH:CVE-2021-42013", "hash": "c5a7a774812c238d89e251655f6d5b53", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-42013", "description": "A path transversal and remote code execution flaw was found in Apache HTTP Server 2.4.49 and 2.4.50. A remote attacker could use this flaw to map URLs to files outside the expected document root. Additionally, this flaw could leak the source of interpreted files like CGI scripts. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This is an incomplete fix for CVE-2021-41773.\n", "published": "2021-10-07T17:33:09", "modified": "2021-10-13T17:49:06", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-42013", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2011900"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T19:28:25", "history": [], "viewCount": 34, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-280-01", "SSA-2021-278-01"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "httpd", "idList": ["HTTPD:2C849FE5B165E832EE21ADAECFA9521C", "HTTPD:E1C40920F9DFC60284EEE7539DA30483"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024", "D001C189-2793-11EC-8FB1-206A8A720317"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-13T19:28:25", "rev": 2}, "score": {"value": 6.6, "vector": "NONE", "modified": "2021-10-13T19:28:25", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "8.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, "lastseen": "2021-10-13T19:28:25", "differentElements": ["modified"], "edition": 6}, {"bulletin": {"id": "RH:CVE-2021-42013", "hash": "f000dbce17e89a780dfdc3c5fc36a22c", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-42013", "description": "A path transversal and remote code execution flaw was found in Apache HTTP Server 2.4.49 and 2.4.50. A remote attacker could use this flaw to map URLs to files outside the expected document root. Additionally, this flaw could leak the source of interpreted files like CGI scripts. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This is an incomplete fix for CVE-2021-41773.\n", "published": "2021-10-07T17:33:09", "modified": "2021-10-15T00:16:05", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-42013", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2011900"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-15T01:27:01", "history": [], "viewCount": 34, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "threatpost", "idList": ["THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-15T01:27:01", "rev": 2}, "score": {"value": 6.6, "vector": "NONE", "modified": "2021-10-15T01:27:01", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "8.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, "lastseen": "2021-10-15T01:27:01", "differentElements": ["cvss"], "edition": 7}, {"bulletin": {"id": "RH:CVE-2021-42013", "hash": "537ab3d9a72d9d20c356102057d887da", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-42013", "description": "A path transversal and remote code execution flaw was found in Apache HTTP Server 2.4.49 and 2.4.50. A remote attacker could use this flaw to map URLs to files outside the expected document root. Additionally, this flaw could leak the source of interpreted files like CGI scripts. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased paths, this could allow for remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This is an incomplete fix for CVE-2021-41773.\n", "published": "2021-10-07T17:33:09", "modified": "2021-10-15T00:16:05", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-42013", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2011900"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-16T10:30:45", "history": [], "viewCount": 34, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "threatpost", "idList": ["THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-15T01:27:01", "rev": 2}, "score": {"value": 6.6, "vector": "NONE", "modified": "2021-10-15T01:27:01", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "8.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, "lastseen": "2021-10-16T10:30:45", "differentElements": ["modified"], "edition": 8}], "viewCount": 35, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["AL2_ALAS-2021-1716.NASL", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014", "ALA_ALAS-2021-1543.NASL"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "slackware", "idList": ["SSA-2021-280-01", "SSA-2021-278-01"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF", "FEDORA:00C4C3098596"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "httpd", "idList": ["HTTPD:2C849FE5B165E832EE21ADAECFA9521C", "HTTPD:E1C40920F9DFC60284EEE7539DA30483"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "exploitdb", "idList": ["EDB-ID:50406", "EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854", "1337DAY-ID-36897"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "threatpost", "idList": ["THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "wallarmlab", "idList": ["WALLARMLAB:6D3FED0879553B4C47AD26ED1DEB5AEB"]}, {"type": "amazon", "idList": ["ALAS2-2021-1716", "ALAS-2021-1543"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-16T13:27:55", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2021-10-16T13:27:55", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "8.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "_object_type": "robots.models.redhatcve.RedhatCVEBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.redhatcve.RedhatCVEBulletin"]}, {"id": "RH:CVE-2021-41524", "hash": "bd8b027f3c29244999eb72e61cf2d0a4", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-41524", "description": "While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.\n", "published": "2021-10-05T17:08:31", "modified": "2021-10-13T12:27:48", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-41524", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2010934"], "cvelist": ["CVE-2021-41524"], "immutableFields": [], "lastseen": "2021-10-13T13:27:08", "history": [{"bulletin": {"id": "RH:CVE-2021-41524", "hash": "82d550a0dc0f26ffcf04eccbf9c3bf52", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-41524", "description": "While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.\n", "published": "2021-10-05T17:08:31", "modified": "2021-10-05T17:08:31", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-41524", "reporter": "redhat.com", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=2010934"], "cvelist": ["CVE-2021-41524"], "immutableFields": [], "lastseen": "2021-10-05T19:30:51", "history": [], "viewCount": 4, "enchantments": {}, "objectVersion": "1.6", "vendorCvss": {"score": "7.5", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}, "lastseen": "2021-10-05T19:30:51", "differentElements": ["modified", "references"], "edition": 1}, {"bulletin": {"id": "RH:CVE-2021-41524", "hash": "e04a87e2944243bce0bfdd4758126566", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-41524", "description": "While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.\n", "published": "2021-10-05T17:08:31", "modified": "2021-10-06T05:01:04", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-41524", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2010934"], "cvelist": ["CVE-2021-41524"], "immutableFields": [], "lastseen": "2021-10-06T07:28:20", "history": [], "viewCount": 4, "enchantments": {}, "objectVersion": "1.6", "vendorCvss": {"score": "7.5", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}, "lastseen": "2021-10-06T07:28:20", "differentElements": ["modified"], "edition": 2}, {"bulletin": {"id": "RH:CVE-2021-41524", "hash": "a8d959774029ff1fc41d219982029875", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-41524", "description": "While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.\n", "published": "2021-10-05T17:08:31", "modified": "2021-10-06T07:57:14", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-41524", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2010934"], "cvelist": ["CVE-2021-41524"], "immutableFields": [], "lastseen": "2021-10-06T10:30:09", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "ubuntucve", "idList": ["UB:CVE-2021-41524"]}, {"type": "cve", "idList": ["CVE-2021-41524"]}, {"type": "httpd", "idList": ["HTTPD:9BD7C7441A852DCB472C001D2290429F"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "fedora", "idList": ["FEDORA:9501630AAF04"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T10:30:09", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-06T10:30:09", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "7.5", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}, "lastseen": "2021-10-06T10:30:09", "differentElements": ["cvss", "modified"], "edition": 3}], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "ubuntucve", "idList": ["UB:CVE-2021-41524"]}, {"type": "cve", "idList": ["CVE-2021-41524"]}, {"type": "httpd", "idList": ["HTTPD:9BD7C7441A852DCB472C001D2290429F"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "fedora", "idList": ["FEDORA:9501630AAF04"]}, {"type": "nessus", "idList": ["AL2_ALAS-2021-1716.NASL", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_50.NASL", "WEB_APPLICATION_SCANNING_113014", "ALA_ALAS-2021-1543.NASL"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "amazon", "idList": ["ALAS2-2021-1716", "ALAS-2021-1543"]}], "modified": "2021-10-13T13:27:08", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-13T13:27:08", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "7.5", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "_object_type": "robots.models.redhatcve.RedhatCVEBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.redhatcve.RedhatCVEBulletin"]}, {"id": "RH:CVE-2021-41773", "hash": "423dd1188b9a1adfec35737810b658ed", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A path transversal flaw was found in Apache 2.4.49. A remote attacker could use this flaw to map URLs to files outside the expected document root. Additionally this flaw could leak the source of interpreted files like CGI scripts.\n", "published": "2021-10-05T13:27:36", "modified": "2021-10-13T12:27:48", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-41773", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2010757"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-13T13:27:17", "history": [{"bulletin": {"id": "RH:CVE-2021-41773", "hash": "ed09805c2b5b434f9aba83e4ebb2ad6e", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \"require all denied\" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n", "published": "2021-10-05T13:27:36", "modified": "2021-10-05T16:02:11", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-41773", "reporter": "redhat.com", "references": ["https://bugzilla.redhat.com/show_bug.cgi?id=2010757"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-05T16:29:22", "history": [], "viewCount": 8, "enchantments": {}, "objectVersion": "1.6", "vendorCvss": {"score": "7.5", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}, "lastseen": "2021-10-05T16:29:22", "differentElements": ["description", "modified", "references"], "edition": 1}, {"bulletin": {"id": "RH:CVE-2021-41773", "hash": "3f45afb136fcdbff81c867f62810d18a", "type": "redhatcve", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A path transversal flaw was found in Apache 2.4.49. A remote attacker could use this flaw to map URLs to files outside the expected document root. Additionally this flaw could leak the source of interpreted files like CGI scripts.\n", "published": "2021-10-05T13:27:36", "modified": "2021-10-06T05:01:04", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://access.redhat.com/security/cve/cve-2021-41773", "reporter": "redhat.com", "references": ["https://httpd.apache.org/security/vulnerabilities_24.html", "https://bugzilla.redhat.com/show_bug.cgi?id=2010757"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T07:27:24", "history": [], "viewCount": 15, "enchantments": {"dependencies": {"references": [{"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "nessus", "idList": ["APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_50.NASL", "WEB_APPLICATION_SCANNING_113014", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "threatpost", "idList": ["THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-42013"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}], "modified": "2021-10-06T07:27:24", "rev": 2}, "score": {"value": 4.7, "vector": "NONE", "modified": "2021-10-06T07:27:24", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "7.5", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}, "lastseen": "2021-10-06T07:27:24", "differentElements": ["cvss", "modified"], "edition": 2}], "viewCount": 17, "enchantments": {"dependencies": {"references": [{"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "attackerkb", "idList": ["AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C"]}, {"type": "nessus", "idList": ["AL2_ALAS-2021-1716.NASL", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "ALA_ALAS-2021-1543.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "threatpost", "idList": ["THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "wallarmlab", "idList": ["WALLARMLAB:6D3FED0879553B4C47AD26ED1DEB5AEB"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-280-01", "SSA-2021-278-01"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF", "FEDORA:00C4C3098596"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "redhatcve", "idList": ["RH:CVE-2021-42013"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "amazon", "idList": ["ALAS2-2021-1716", "ALAS-2021-1543"]}], "modified": "2021-10-13T13:27:17", "rev": 2}, "score": {"value": 4.6, "vector": "NONE", "modified": "2021-10-13T13:27:17", "rev": 2}}, "objectVersion": "1.6", "vendorCvss": {"score": "7.5", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "_object_type": "robots.models.redhatcve.RedhatCVEBulletin", "_object_types": ["robots.models.base.Bulletin", "robots.models.redhatcve.RedhatCVEBulletin"]}], "attackerkb": [{"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4cbc5286bef2b5ed424a33aec4c3c06", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \u201crequire all denied\u201d, these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-15T00:00:00", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/", "http://www.openwall.com/lists/oss-security/2021/10/15/3", "http://www.openwall.com/lists/oss-security/2021/10/16/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-23T22:42:34", "history": [{"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "7eeac13c56bbc42a0b0dbc86769bd425", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-05T16:44:44", "history": [], "viewCount": 2, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "default_configuration", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-05T15:29:00"}, "lastseen": "2021-10-05T16:44:44", "differentElements": ["last_activity", "tags"], "edition": 1}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "39b071b7acbff0596b638c11bb6fa117", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-05T19:43:25", "history": [], "viewCount": 2, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-05T18:00:00"}, "lastseen": "2021-10-05T19:43:25", "differentElements": ["href"], "edition": 2}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "1fcdff1d6baa6b8b9adac0ae92aa1822", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-05T19:44:46", "history": [], "viewCount": 2, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-05T18:00:00"}, "lastseen": "2021-10-05T19:44:46", "differentElements": ["href"], "edition": 3}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "39b071b7acbff0596b638c11bb6fa117", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-05T22:42:14", "history": [], "viewCount": 3, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-05T18:00:00"}, "lastseen": "2021-10-05T22:42:14", "differentElements": ["href"], "edition": 4}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "1fcdff1d6baa6b8b9adac0ae92aa1822", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T01:42:23", "history": [], "viewCount": 3, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-05T18:00:00"}, "lastseen": "2021-10-06T01:42:23", "differentElements": ["href"], "edition": 5}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "39b071b7acbff0596b638c11bb6fa117", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T04:42:11", "history": [], "viewCount": 3, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-05T18:00:00"}, "lastseen": "2021-10-06T04:42:11", "differentElements": ["href"], "edition": 6}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "1fcdff1d6baa6b8b9adac0ae92aa1822", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-05T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T04:43:45", "history": [], "viewCount": 3, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-05T18:00:00"}, "lastseen": "2021-10-06T04:43:45", "differentElements": ["last_activity", "modified"], "edition": 7}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "25db8ef19a8c12f317e9d31db4fa37fe", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T07:41:52", "history": [], "viewCount": 3, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T00:00:00"}, "lastseen": "2021-10-06T07:41:52", "differentElements": ["href"], "edition": 8}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "e8394a24715e739cd62fe4fca37aae9b", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T07:42:45", "history": [], "viewCount": 4, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T00:00:00"}, "lastseen": "2021-10-06T07:42:45", "differentElements": ["last_activity", "wildExploitedCategory", "wildExploitedReports"], "edition": 9}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "0fcf3e8e8e6c449becd5e43ec933f021", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T10:46:04", "history": [], "viewCount": 4, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T09:25:00"}, "lastseen": "2021-10-06T10:46:04", "differentElements": ["href"], "edition": 10}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "764f7e2d19faa7850d8cd0acf91165a8", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773/rapid7-analysis", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T10:46:28", "history": [], "viewCount": 4, "enchantments": {}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T09:25:00"}, "lastseen": "2021-10-06T10:46:28", "differentElements": ["href"], "edition": 11}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "0fcf3e8e8e6c449becd5e43ec933f021", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T13:44:34", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T09:25:00"}, "lastseen": "2021-10-06T13:44:34", "differentElements": ["last_activity"], "edition": 12}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "f7b0503f5ba2219d69cafa5d9d037226", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T16:44:15", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-06T16:44:15", "differentElements": ["href"], "edition": 13}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "456962b40f33c3a26574ab74638cd494", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T16:45:36", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-06T16:45:36", "differentElements": ["references", "references_categories"], "edition": 14}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "2183487e7e7172987283ea56af80b2b0", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T19:42:22", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-06T19:42:22", "differentElements": ["href"], "edition": 15}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "73d1b3f11c51c526906115cac0d2b77c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T19:43:15", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-06T19:43:15", "differentElements": ["href"], "edition": 16}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "2183487e7e7172987283ea56af80b2b0", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-06T22:42:05", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-06T22:42:05", "differentElements": ["href"], "edition": 17}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "73d1b3f11c51c526906115cac0d2b77c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-07T01:41:44", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-07T01:41:44", "differentElements": ["href"], "edition": 18}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "2183487e7e7172987283ea56af80b2b0", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-07T04:41:21", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-07T04:41:21", "differentElements": ["href"], "edition": 19}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "73d1b3f11c51c526906115cac0d2b77c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-07T07:41:30", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-07T07:41:30", "differentElements": ["href"], "edition": 20}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "2183487e7e7172987283ea56af80b2b0", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-07T10:41:51", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-07T10:41:51", "differentElements": ["href"], "edition": 21}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "73d1b3f11c51c526906115cac0d2b77c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-07T10:42:00", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-07T10:42:00", "differentElements": ["href", "references", "references_categories"], "edition": 22}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "6b31890462ffe428f50aef28218c6fc1", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-07T13:42:46", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-07T13:42:46", "differentElements": ["href"], "edition": 23}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "988939a489dc2b1263a40bdb071a8204", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-07T13:43:54", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-07T13:43:54", "differentElements": ["href", "references", "references_categories"], "edition": 24}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "171d469394134e2c7d74f0943ca46bff", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-07T16:46:22", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-07T16:46:22", "differentElements": ["href"], "edition": 25}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "54bb193843e73c00f3d015e6c46e0c45", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-06T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773"], "immutableFields": [], "lastseen": "2021-10-07T16:46:48", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-06T14:10:00"}, "lastseen": "2021-10-07T16:46:48", "differentElements": ["cvelist", "description", "last_activity", "modified", "references", "references_categories"], "edition": 26}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "91099c5bd6f5f6d4e4698e54e5fdd929", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-07T19:41:36", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-07T19:41:36", "differentElements": ["href"], "edition": 27}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "861b3ce0b672e01a174ebd2a9e378207", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-07T19:41:42", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-07T19:41:42", "differentElements": ["href"], "edition": 28}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "91099c5bd6f5f6d4e4698e54e5fdd929", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-07T22:47:06", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-07T22:47:06", "differentElements": ["references", "references_categories"], "edition": 29}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "3ea123801c7c8e5453bdf0cb7d795d7f", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T01:41:33", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T01:41:33", "differentElements": ["href"], "edition": 30}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "71bf801feee128b544b05fc1c926b1be", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T01:41:55", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T01:41:55", "differentElements": ["href"], "edition": 31}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "3ea123801c7c8e5453bdf0cb7d795d7f", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T04:42:18", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T04:42:18", "differentElements": ["href"], "edition": 32}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "71bf801feee128b544b05fc1c926b1be", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T07:42:29", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T07:42:29", "differentElements": ["href"], "edition": 33}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "3ea123801c7c8e5453bdf0cb7d795d7f", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T07:43:02", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T07:43:02", "differentElements": ["references", "references_categories"], "edition": 34}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "297442fbb1f3412ae2f92ae4c5e4e556", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T11:10:53", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T11:10:53", "differentElements": ["href"], "edition": 35}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "f82fe879ea8481152c6a7ddf5141e7c1", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T11:11:45", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T11:11:45", "differentElements": ["href"], "edition": 36}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "297442fbb1f3412ae2f92ae4c5e4e556", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T13:41:05", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-41773"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:39F966BC26E5C39D44AE447C698C16F7", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:B3345C724E52DA189A569DB96117AE62", "THREATPOST:C08F7CE31866AD122E0E91538769B34A", "THREATPOST:3E4A550C6B111092596E7A37F53A49B6", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "slackware", "idList": ["SSA-2021-278-01"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}], "modified": "2021-10-06T13:44:34", "rev": 2}, "score": {"value": 5.4, "vector": "NONE", "modified": "2021-10-06T13:44:34", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T13:41:05", "differentElements": ["href"], "edition": 37}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "f82fe879ea8481152c6a7ddf5141e7c1", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T13:43:29", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T13:43:29", "differentElements": ["references", "references_categories"], "edition": 38}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "08d56af2a3342e8f56301177394da625", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T16:50:32", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T16:50:32", "differentElements": ["href"], "edition": 39}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "3f16233d714fb4d7b47249a852f9b55a", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T16:51:31", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T16:51:31", "differentElements": ["href"], "edition": 40}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "08d56af2a3342e8f56301177394da625", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T19:41:16", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T19:41:16", "differentElements": ["href"], "edition": 41}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "3f16233d714fb4d7b47249a852f9b55a", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T19:42:19", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T19:42:19", "differentElements": ["href", "references", "references_categories"], "edition": 42}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "cf9394fc2d3fbb555174c2bca6b77b27", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T22:41:17", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T22:41:17", "differentElements": ["href"], "edition": 43}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "540c2b1d3c08d980e911d4ab26d32394", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-08T22:42:02", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-08T22:42:02", "differentElements": ["references", "references_categories"], "edition": 44}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "8e0768751d526cd6560b4fac4d2d095c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T01:41:52", "history": [], "viewCount": 4, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T01:41:52", "differentElements": ["href"], "edition": 45}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "626447bcffca0de3e829827199ffccb8", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T01:42:24", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T01:42:24", "differentElements": ["href"], "edition": 46}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "8e0768751d526cd6560b4fac4d2d095c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T04:42:11", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T04:42:11", "differentElements": ["href"], "edition": 47}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "626447bcffca0de3e829827199ffccb8", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T04:42:35", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T04:42:35", "differentElements": ["href"], "edition": 48}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "8e0768751d526cd6560b4fac4d2d095c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T07:41:53", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T07:41:53", "differentElements": ["href"], "edition": 49}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "626447bcffca0de3e829827199ffccb8", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T07:42:38", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T07:42:38", "differentElements": ["href"], "edition": 50}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "8e0768751d526cd6560b4fac4d2d095c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T10:41:05", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T10:41:05", "differentElements": ["href"], "edition": 51}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "626447bcffca0de3e829827199ffccb8", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T10:41:30", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T10:41:30", "differentElements": ["href"], "edition": 52}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "8e0768751d526cd6560b4fac4d2d095c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T13:41:48", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T13:41:48", "differentElements": ["href"], "edition": 53}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "626447bcffca0de3e829827199ffccb8", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T16:43:04", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T16:43:04", "differentElements": ["href"], "edition": 54}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "8e0768751d526cd6560b4fac4d2d095c", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T19:41:26", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T19:41:26", "differentElements": ["href"], "edition": 55}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "626447bcffca0de3e829827199ffccb8", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T19:42:22", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T19:42:22", "differentElements": ["href", "references", "references_categories"], "edition": 56}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T22:42:06", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T22:42:06", "differentElements": ["href"], "edition": 57}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-09T22:42:41", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-09T22:42:41", "differentElements": ["href"], "edition": 58}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T01:41:11", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T01:41:11", "differentElements": ["href"], "edition": 59}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T04:42:31", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T04:42:31", "differentElements": ["href"], "edition": 60}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T07:42:05", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T07:42:05", "differentElements": ["href"], "edition": 61}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T10:41:18", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T10:41:18", "differentElements": ["href"], "edition": 62}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T13:42:05", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T13:42:05", "differentElements": ["href"], "edition": 63}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T16:41:53", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T16:41:53", "differentElements": ["href"], "edition": 64}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T16:43:26", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T16:43:26", "differentElements": ["href"], "edition": 65}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T19:42:38", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T19:42:38", "differentElements": ["href"], "edition": 66}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T22:45:53", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T22:45:53", "differentElements": ["href"], "edition": 67}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-10T22:46:23", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-10T22:46:23", "differentElements": ["href"], "edition": 68}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T01:42:25", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T01:42:25", "differentElements": ["href"], "edition": 69}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T01:45:00", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T01:45:00", "differentElements": ["href"], "edition": 70}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T04:43:07", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T04:43:07", "differentElements": ["href"], "edition": 71}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T04:44:47", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T04:44:47", "differentElements": ["href"], "edition": 72}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T07:43:46", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T07:43:46", "differentElements": ["href"], "edition": 73}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T10:43:06", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T10:43:06", "differentElements": ["href"], "edition": 74}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "c1f6f1be84512a94c2fe6b15d85c3cd5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T10:43:34", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024"]}], "modified": "2021-10-08T13:43:29", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-08T13:43:29", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T10:43:34", "differentElements": ["href"], "edition": 75}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "a4f79ee154bd1b1825a022d7c1890ea2", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T13:42:10", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T13:42:10", "differentElements": ["href", "references", "references_categories"], "edition": 76}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "e05b25ba7dc9bc79ac637de0f2f8fe2b", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T16:41:53", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T16:41:53", "differentElements": ["href"], "edition": 77}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "3c9124441466c75215927d9446bcc2f1", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T16:42:51", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T16:42:51", "differentElements": ["href"], "edition": 78}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "e05b25ba7dc9bc79ac637de0f2f8fe2b", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T19:43:15", "history": [], "viewCount": 5, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T19:43:15", "differentElements": ["href"], "edition": 79}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "3c9124441466c75215927d9446bcc2f1", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-11T19:43:32", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-11T19:43:32", "differentElements": ["href"], "edition": 80}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "e05b25ba7dc9bc79ac637de0f2f8fe2b", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T01:42:08", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T01:42:08", "differentElements": ["href"], "edition": 81}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "3c9124441466c75215927d9446bcc2f1", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T01:42:24", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T01:42:24", "differentElements": ["href"], "edition": 82}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "e05b25ba7dc9bc79ac637de0f2f8fe2b", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T04:41:11", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T04:41:11", "differentElements": ["href"], "edition": 83}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "3c9124441466c75215927d9446bcc2f1", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T04:41:42", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T04:41:42", "differentElements": ["href"], "edition": 84}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "e05b25ba7dc9bc79ac637de0f2f8fe2b", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T07:47:55", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T07:47:55", "differentElements": ["mitre_vector"], "edition": 85}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "ba31778a540f11f4d5f15edec2787b55", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T10:41:14", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T10:41:14", "differentElements": ["href"], "edition": 86}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "2da411557c3d28c0af424fcd8f185979", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T10:44:10", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T10:44:10", "differentElements": ["href"], "edition": 87}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "ba31778a540f11f4d5f15edec2787b55", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T13:41:11", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T13:41:11", "differentElements": ["href"], "edition": 88}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "2da411557c3d28c0af424fcd8f185979", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T13:41:17", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T13:41:17", "differentElements": ["href"], "edition": 89}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "ba31778a540f11f4d5f15edec2787b55", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T16:42:01", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T16:42:01", "differentElements": ["href"], "edition": 90}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "2da411557c3d28c0af424fcd8f185979", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T19:41:09", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T19:41:09", "differentElements": ["href"], "edition": 91}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "ba31778a540f11f4d5f15edec2787b55", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-12T22:41:20", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-12T22:41:20", "differentElements": ["href"], "edition": 92}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "2da411557c3d28c0af424fcd8f185979", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T01:59:43", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-13T01:59:43", "differentElements": ["href", "references", "references_categories"], "edition": 93}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "d6893add05c190481ae0366a8a052897", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-07T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T04:45:19", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-07T00:00:00"}, "lastseen": "2021-10-13T04:45:19", "differentElements": ["href", "last_activity", "modified"], "edition": 94}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "21755f5ef5aefa733608dd19832027b1", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T07:41:10", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-13T07:41:10", "differentElements": ["href"], "edition": 95}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "efaf7c2b732937150b5e0564b12c56d5", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T07:41:16", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_50.NASL"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-11T13:42:10", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-11T13:42:10", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-13T07:41:16", "differentElements": ["cvss", "href"], "edition": 96}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "cf0073388c6f849f39e3ef7b59754ac9", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T10:41:17", "history": [], "viewCount": 8, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_50.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854", "1337DAY-ID-36897"]}, {"type": "exploitdb", "idList": ["EDB-ID:50406", "EDB-ID:50383"]}, {"type": "threatpost", "idList": ["THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-13T10:41:17", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-13T10:41:17", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-13T10:41:17", "differentElements": ["href"], "edition": 97}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "144fcac275bb55e98d6981220e75e11d", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T13:41:46", "history": [], "viewCount": 8, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_50.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854", "1337DAY-ID-36897"]}, {"type": "exploitdb", "idList": ["EDB-ID:50406", "EDB-ID:50383"]}, {"type": "threatpost", "idList": ["THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-13T10:41:17", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-13T10:41:17", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-13T13:41:46", "differentElements": ["href"], "edition": 98}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "cf0073388c6f849f39e3ef7b59754ac9", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T16:42:01", "history": [], "viewCount": 8, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "APACHE_2_4_51.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_50.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854", "1337DAY-ID-36897"]}, {"type": "exploitdb", "idList": ["EDB-ID:50406", "EDB-ID:50383"]}, {"type": "threatpost", "idList": ["THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-13T10:41:17", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-13T10:41:17", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-13T16:42:01", "differentElements": ["href"], "edition": 99}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "144fcac275bb55e98d6981220e75e11d", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-13T19:41:18", "history": [], "viewCount": 9, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-280-01", "SSA-2021-278-01"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "httpd", "idList": ["HTTPD:2C849FE5B165E832EE21ADAECFA9521C", "HTTPD:E1C40920F9DFC60284EEE7539DA30483"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024", "D001C189-2793-11EC-8FB1-206A8A720317"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-13T19:41:18", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-13T19:41:18", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-13T19:41:18", "differentElements": ["href"], "edition": 100}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "cf0073388c6f849f39e3ef7b59754ac9", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-14T01:41:14", "history": [], "viewCount": 9, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-280-01", "SSA-2021-278-01"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "httpd", "idList": ["HTTPD:2C849FE5B165E832EE21ADAECFA9521C", "HTTPD:E1C40920F9DFC60284EEE7539DA30483"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024", "D001C189-2793-11EC-8FB1-206A8A720317"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-13T19:41:18", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-13T19:41:18", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-14T01:41:14", "differentElements": ["href"], "edition": 101}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "144fcac275bb55e98d6981220e75e11d", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-14T04:41:36", "history": [], "viewCount": 9, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-41773", "RH:CVE-2021-42013"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_50.NASL", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-280-01", "SSA-2021-278-01"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "httpd", "idList": ["HTTPD:2C849FE5B165E832EE21ADAECFA9521C", "HTTPD:E1C40920F9DFC60284EEE7539DA30483"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024", "D001C189-2793-11EC-8FB1-206A8A720317"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "threatpost", "idList": ["THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:49DCD8325E10F7898739335BD99AE94B"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-13T19:41:18", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-13T19:41:18", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-14T04:41:36", "differentElements": ["href"], "edition": 102}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "cf0073388c6f849f39e3ef7b59754ac9", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-14T07:41:19", "history": [], "viewCount": 10, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "cve", "idList": ["CVE-2021-42013", "CVE-2021-41773"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-42013", "UB:CVE-2021-41773"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "WEB_APPLICATION_SCANNING_113014", "APACHE_2_4_51.NASL", "APACHE_2_4_50.NASL", "APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL"]}, {"type": "thn", "idList": ["THN:A0816B13A402B9865C624E3CA1B06EA5", "THN:C6F6C1EB007027C65DE14DE5DA3E74BC"]}, {"type": "slackware", "idList": ["SSA-2021-280-01", "SSA-2021-278-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:78B08801DAA7C3B8A2D34A5790730C76", "CISA:76FE595B1B89D06301E16CB8087D39BD"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "httpd", "idList": ["HTTPD:2C849FE5B165E832EE21ADAECFA9521C", "HTTPD:E1C40920F9DFC60284EEE7539DA30483"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "zdt", "idList": ["1337DAY-ID-36854", "1337DAY-ID-36897"]}, {"type": "freebsd", "idList": ["D001C189-2793-11EC-8FB1-206A8A720317", "25B78BDD-25B8-11EC-A341-D4C9EF517024"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164501", "PACKETSTORM:164418"]}, {"type": "threatpost", "idList": ["THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-14T07:41:19", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-14T07:41:19", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-14T07:41:19", "differentElements": ["href"], "edition": 103}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "144fcac275bb55e98d6981220e75e11d", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-14T13:43:22", "history": [], "viewCount": 11, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "APACHE_2_4_50.NASL", "WEB_APPLICATION_SCANNING_113014", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024", "D001C189-2793-11EC-8FB1-206A8A720317"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "threatpost", "idList": ["THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-14T13:43:22", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-14T13:43:22", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-14T13:43:22", "differentElements": ["href"], "edition": 104}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "cf0073388c6f849f39e3ef7b59754ac9", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-14T19:43:35", "history": [], "viewCount": 11, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "APACHE_2_4_50.NASL", "WEB_APPLICATION_SCANNING_113014", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024", "D001C189-2793-11EC-8FB1-206A8A720317"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "threatpost", "idList": ["THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-14T13:43:22", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-14T13:43:22", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-14T19:43:35", "differentElements": ["href"], "edition": 105}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "144fcac275bb55e98d6981220e75e11d", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-14T22:41:44", "history": [], "viewCount": 12, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "APACHE_2_4_50.NASL", "WEB_APPLICATION_SCANNING_113014", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024", "D001C189-2793-11EC-8FB1-206A8A720317"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "threatpost", "idList": ["THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-14T13:43:22", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-14T13:43:22", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-14T22:41:44", "differentElements": ["href"], "edition": 106}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "cf0073388c6f849f39e3ef7b59754ac9", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/comments/6da14dec-add0-45e6-8b9e-7669877de394", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-15T01:42:17", "history": [], "viewCount": 12, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "APACHE_2_4_50.NASL", "WEB_APPLICATION_SCANNING_113014", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024", "D001C189-2793-11EC-8FB1-206A8A720317"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "threatpost", "idList": ["THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-14T13:43:22", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-14T13:43:22", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-15T01:42:17", "differentElements": ["href"], "edition": 107}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "144fcac275bb55e98d6981220e75e11d", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \u201crequire all denied\u201d these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild.\n\nThis issue only affects Apache 2.4.49 and 2.4.50 not earlier versions.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-13T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"], "cvelist": ["CVE-2021-41773", "CVE-2021-42013"], "immutableFields": [], "lastseen": "2021-10-15T01:42:20", "history": [], "viewCount": 12, "enchantments": {"dependencies": {"references": [{"type": "redhatcve", "idList": ["RH:CVE-2021-42013", "RH:CVE-2021-41773"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:9C7E6BE350F06790928CFF68E04A6ECE"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2021-41773", "UB:CVE-2021-42013"]}, {"type": "cve", "idList": ["CVE-2021-41773", "CVE-2021-42013"]}, {"type": "akamaiblog", "idList": ["AKAMAIBLOG:72129348AFF386C88DD2D4145C64F678"]}, {"type": "nessus", "idList": ["APACHE_2_4_49_PATH_TRAVERSAL.NBIN", "APACHE_2_4_51.NASL", "FREEBSD_PKG_D001C189279311EC8FB1206A8A720317.NASL", "APACHE_2_4_50.NASL", "WEB_APPLICATION_SCANNING_113014", "FREEBSD_PKG_25B78BDD25B811ECA341D4C9EF517024.NASL"]}, {"type": "thn", "idList": ["THN:C6F6C1EB007027C65DE14DE5DA3E74BC", "THN:A0816B13A402B9865C624E3CA1B06EA5"]}, {"type": "slackware", "idList": ["SSA-2021-278-01", "SSA-2021-280-01"]}, {"type": "jvn", "idList": ["JVN:51106450"]}, {"type": "cisa", "idList": ["CISA:76FE595B1B89D06301E16CB8087D39BD", "CISA:78B08801DAA7C3B8A2D34A5790730C76"]}, {"type": "fedora", "idList": ["FEDORA:BDD0730B86DF"]}, {"type": "httpd", "idList": ["HTTPD:E1C40920F9DFC60284EEE7539DA30483", "HTTPD:2C849FE5B165E832EE21ADAECFA9521C"]}, {"type": "malwarebytes", "idList": ["MALWAREBYTES:916ADA06F0F0B2E4CCBAE56C7FEA87D1"]}, {"type": "cisco", "idList": ["CISCO-SA-APACHE-HTTPD-PATHTRV-LAZG68CZ"]}, {"type": "freebsd", "idList": ["25B78BDD-25B8-11EC-A341-D4C9EF517024", "D001C189-2793-11EC-8FB1-206A8A720317"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164418", "PACKETSTORM:164501"]}, {"type": "exploitdb", "idList": ["EDB-ID:50383", "EDB-ID:50406"]}, {"type": "zdt", "idList": ["1337DAY-ID-36897", "1337DAY-ID-36854"]}, {"type": "threatpost", "idList": ["THREATPOST:5F0369916D5AFC90C3AF027AC4EC4A61", "THREATPOST:49DCD8325E10F7898739335BD99AE94B", "THREATPOST:8325094507099F4F089C61EF2997445C", "THREATPOST:641CEDBD77D5E4711F6E56353D7B5E33"]}, {"type": "hivepro", "idList": ["HIVEPRO:7FC9DCD27C78F4BFA53C84B6CB04EC19"]}], "modified": "2021-10-14T13:43:22", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-10-14T13:43:22", "rev": 2}}, "objectVersion": "1.6", "attackerkb": {"attackerValue": 4, "exploitability": 5}, "wildExploited": true, "wildExploitedCategory": {"Vendor Advisory": "", "Threat Feed": ""}, "wildExploitedReports": [{"category": "Vendor Advisory", "source_url": "https://httpd.apache.org/security/vulnerabilities_24.html", "published": "2021-10-05T14:32:00"}, {"category": "Threat Feed", "source_url": "https://www.greynoise.io/viz/query/?gnql=cve%3ACVE-2021-41773", "published": "2021-10-06T09:25:00"}], "references_categories": {"Canonical": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773"], "Advisory": ["https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/"], "Miscellaneous": ["https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html"]}, "tags": ["common_enterprise", "easy_to_develop", "pre_auth", "no_useful_data"], "mitre_vector": {"Initial Access": ["External Remote Services(Validated)"]}, "last_activity": "2021-10-13T00:00:00"}, "lastseen": "2021-10-15T01:42:20", "differentElements": ["description", "last_activity", "modified", "references", "references_categories"], "edition": 108}, {"bulletin": {"id": "AKB:4BB9D3C7-37EF-4B65-B2A8-550AFC30664C", "hash": "93bcb6208a6a8e0546a78d1c95ba6160", "type": "attackerkb", "bulletinFamily": "info", "title": "CVE-2021-41773", "description": "A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \u201crequire all denied\u201d, these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.\n\n \n**Recent assessments:** \n \n**zeroSteiner** at October 05, 2021 3:29pm UTC reported:\n\nApache doesn\u2019t typically run with root privileges in most environments so the value of this vulnerability will largely be in using it to leak application-specific secrets such as signing keys, database connection strings, source code etc. Path traversal vulnerabilities are among the easiest to exploit and involve no type of corruption, making them very reliable and safe to use multiple times.\n\nThere will likely be evidence within the Apache access logs of exploitation. Filtering on the HTTP status code could also provide insight into what files the attacker was able to successfully leak.\n\nAssessed Attacker Value: 4 \nAssessed Attacker Value: 4Assessed Attacker Value: 5\n", "published": "2021-10-05T00:00:00", "modified": "2021-10-15T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss2": {}, "cvss3": {}, "href": "https://attackerkb.com/topics/1RltOPCYqE/cve-2021-41773", "reporter": "AttackerKB", "references": ["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773", "https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E", "https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/05/2", "http://www.openwall.com/lists/oss-security/2021/10/07/1", "https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E", "https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/07/6", "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ", "http://www.openwall.com/lists/oss-security/2021/10/08/1", "https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E", "http://www.openwall.com/lists/oss-security/2021/10/08/2", "http://www.openwall.com/lists/oss-security/2021/10/08/3", "http://www.openwall.com/lists/oss-security/2021/10/08/4", "http://www.openwall.com/lists/oss-security/2021/10/08/6", "http://www.openwall.com/lists/oss-security/2021/10/08/5", "http://www.openwall.com/lists/oss-security/2021/10/09/1", "http://www.openwall.com/lists/oss-security/2021/10/11/4", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/", "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/", "https://httpd.apache.org/security/vulnerabilities_24.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html", "http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-