Apache HTTP Server is an open source web server from the Apache Foundation. Apache HTTP Server version 2.4.49 has a path traversal vulnerability, which originates from the ap_normalize_path function introduced without strict checksum, and can be exploited by attackers to obtain sensitive information or take control of the target server.

CPENameOperatorVersion
apache http servereq2.4.49

CPE	Name	Operator	Version
	apache http server	eq	2.4.49

threatpost 4

githubexploit 95

nessus 9

wallarmlab 1

openvas 11

packetstorm 3

nuclei 3

veracode 1

zdt 3

httpd 2

akamaiblog 1

cbl_mariner 1

kitploit 1

redhatcve 2

exploitdb 2

qualysblog 1

impervablog 2

attackerkb 4

ubuntucve 2

cisa_kev 2

osv 4

archlinux 1

slackware 2

hivepro 1

prion 2

cisa 2

altlinux 2

thn 4

freebsd 2

cve 2

metasploit 2

debiancve 2

ibm 1

kaspersky 1

hackerone 2

alpinelinux 2

rapid7blog 2

mageia 2

fedora 2

checkpoint_advisories 1

f5 1

jvn 1

ics 1

photon 2

malwarebytes 1

cisco 1

trellix 2

amazon 1

threatpost

3.1M Neiman Marcus Customer Card Details Breached

2021-10-01 17:50:42

Apache Web Server Zero-Day Actively Exploited, Exposes Sensitive Data

2021-10-05 20:01:27

Transnational Fraud Ring Bilks U.S. Military Service Members Out of Millions

2021-10-04 15:22:32

githubexploit

Exploit for Path Traversal in Apache Http Server

2021-10-05 23:53:48

Exploit for Path Traversal in Apache Http Server

2021-10-07 01:31:13

Exploit for Path Traversal in Apache Http Server

2021-10-08 07:24:49

nessus

Apache 2.4.49 < 2.4.51 Path Traversal

2021-10-08 00:00:00

Apache HTTP Server 2.4.49 Path Traversal (CVE-2021-41773)

2021-10-05 00:00:00

Apache 2.4.49 < 2.4.50 Multiple Vulnerabilities

2021-10-06 00:00:00

wallarmlab

Wallarm starts to highlight CVE to address OWASP Top-10 A6 Vulnerable and Outdated Components

2021-10-15 23:13:35

openvas

Apache HTTP Server 2.4.49 Directory Traversal / RCE Vulnerability - Active Check

2021-10-06 00:00:00

Apache HTTP Server 2.4.49 Multiple Vulnerabilities - Linux

2021-10-05 00:00:00

Fedora: Security Advisory for httpd (FEDORA-2021-2a10bc68a4)

2021-10-21 00:00:00

packetstorm

Apache HTTP Server 2.4.49 Path Traversal

2021-10-06 00:00:00

Apache HTTP Server 2.4.50 Remote Code Execution

2021-11-11 00:00:00

Apache 2.4.49 / 2.4.50 Traversal / Remote Code Execution

2021-10-25 00:00:00

nuclei

Apache 2.4.49 - Path Traversal and Remote Code Execution

2021-10-05 14:49:36

Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution

2021-10-07 18:17:29

Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution

2021-10-07 18:17:29

veracode

Path Traversal

2021-10-06 07:50:10

zdt

Apache HTTP Server 2.4.49 - Path Traversal Vulnerability

2021-10-06 00:00:00

Apache 2.4.49 / 2.4.50 Traversal / Remote Code Execution Exploit

2021-10-26 00:00:00

Apache HTTP Server 2.4.50 - Remote Code Execution Exploit (3)

2021-11-11 00:00:00

httpd

Apache Httpd < 2.4.50 : Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

2021-09-29 00:00:00

Apache Httpd < 2.4.51 : Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

2021-10-06 00:00:00

akamaiblog

Mitigating CVE-2021-41773: Apache HTTP Server Path Traversal

2021-10-07 20:15:00

cbl_mariner

CVE-2021-41773 affecting package httpd 2.4.49-1

2021-10-15 04:46:31

kitploit

Scarce-Apache2 - A Framework For Bug Hunting Or Pentesting Targeting Websites That Have CVE-2021-41773 Vulnerability In Public

2021-10-29 20:30:00

redhatcve

CVE-2021-41773

2021-10-05 13:27:36

CVE-2021-42013

2021-10-07 17:33:09

exploitdb

Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)

2021-10-06 00:00:00

Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)

2021-11-11 00:00:00

qualysblog

Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013)

2021-10-28 06:22:22

impervablog

How RASP Protects Apache Servers from zero-day Path Traversal Attacks (CVE-2021-41773)

2021-10-26 19:35:24

Imperva uncovers new Indicators of Compromise for FBI and CISA-flagged AndroxGh0st botnet

2024-01-31 14:03:45

attackerkb

CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

2021-10-08 00:00:00

CVE-2021-41773

2021-10-05 00:00:00

Apache HTTPd 2.4.49/2.4.50 路径穿越漏洞

2021-10-11 00:00:00

ubuntucve

CVE-2021-41773

2021-10-05 00:00:00

CVE-2021-42013

2021-10-07 00:00:00

cisa_kev

Apache HTTP Server Path Traversal Vulnerability

2021-11-03 00:00:00

Apache HTTP Server Path Traversal Vulnerability

2021-11-03 00:00:00

osv

BIT-apache-2021-41773

2024-03-06 10:54:39

BIT-apache-2021-42013

2024-03-06 10:54:27

CVE-2021-42013

2021-10-07 16:15:09

archlinux

[ASA-202110-1] apache: directory traversal

2021-10-21 00:00:00

slackware

[slackware-security] httpd

2021-10-08 03:27:06

[slackware-security] httpd

2021-10-06 01:14:05

hivepro

Multiple vulnerabilities have been discovered in the Apache HTTP Server

2021-10-06 08:57:02

prion

Path traversal

2021-10-07 16:15:00

Path traversal

2021-10-05 09:15:00

cisa

Apache Releases Security Update for Apache HTTP Server

2021-10-06 00:00:00

Apache Releases HTTP Server version 2.4.51 to Address Vulnerabilities Under Exploitation

2021-10-07 00:00:00

altlinux

Security fix for the ALT Linux 10 package apache2 version 1:2.4.50-alt1

2021-10-07 00:00:00

Security fix for the ALT Linux 9 package apache2 version 1:2.4.50-alt1

2021-10-07 00:00:00

thn

Apache Warns of Zero-Day Exploit in the Wild — Patch Your Web Servers Now!

2021-10-05 14:53:00

New Patch Released for Actively Exploited 0-Day Apache Path Traversal to RCE Attacks

2021-10-08 04:47:00

AndroxGh0st Malware Targets Laravel Apps to Steal Cloud Credentials

2024-03-21 12:48:00

freebsd

Apache httpd -- Multiple vulnerabilities

2021-10-05 00:00:00

Apache httpd -- Path Traversal and Remote Code Execution

2021-10-07 00:00:00

cve

CVE-2021-42013

2021-10-07 16:15:00

CVE-2021-41773

2021-10-05 09:15:00

metasploit

Apache 2.4.49/2.4.50 Traversal RCE scanner

2021-10-06 17:00:59

Apache 2.4.49/2.4.50 Traversal RCE

2021-10-08 11:22:47

debiancve

CVE-2021-41773

2021-10-05 09:15:00

CVE-2021-42013

2021-10-07 16:15:00

ibm

Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it. (CVE-2021-42013)

2022-01-17 18:38:24

kaspersky

KLA12371 Multiple vulnerabilities in Apache HTTP Server

2021-10-04 00:00:00

hackerone

Internet Bug Bounty: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

2021-11-08 21:47:54

Internet Bug Bounty: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)

2021-11-14 23:54:06

alpinelinux

CVE-2021-42013

2021-10-07 16:15:00

CVE-2021-41773

2021-10-05 09:15:00

rapid7blog

Apache HTTP Server CVE-2021-41773 Exploited in the Wild

2021-10-06 16:42:32

Metasploit Wrap-Up

2021-10-29 17:59:46

mageia

Updated apache packages fix security vulnerabilities

2021-10-06 17:38:41

Updated apache packages fix security vulnerability

2021-10-08 22:12:12

fedora

[SECURITY] Fedora 34 Update: httpd-2.4.51-1.fc34

2021-10-12 23:46:03

[SECURITY] Fedora 35 Update: httpd-2.4.51-2.fc35

2021-10-15 00:50:08

checkpoint_advisories

Apache HTTP Server Directory Traversal (CVE-2021-41773; CVE-2021-42013)

2021-10-06 00:00:00

K04082144 : Apache HTTP Server vulnerability CVE-2021-41773, CVE-2021-42013

2021-10-21 00:00:00

jvn

JVN#51106450: Apache HTTP Server vulnerable to directory traversal

2021-10-08 00:00:00

ics

Known Indicators of Compromise Associated with Androxgh0st Malware

2024-01-16 12:00:00

photon

Critical Photon OS Security Update - PHSA-2021-0118

2021-10-19 00:00:00

Critical Photon OS Security Update - PHSA-2021-4.0-0118

2021-10-20 00:00:00

malwarebytes

[Updated, again] Apache fixes zero-day vulnerability in HTTP Server

2021-10-06 14:23:08

cisco

Apache HTTP Server Vulnerabilities: October 2021

2021-10-07 16:00:00

trellix

The Bug Report – October Edition

2021-11-02 00:00:00

The Bug Report – October Edition

2021-11-02 00:00:00

amazon

Important: httpd24

2021-10-15 07:52:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

JSON

Related for CNVD-2022-03222