CVE-2021-41773

🗓️ 05 Oct 2021 08:40:12Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 20 Media mentions👁 3620 Views🌐 WEB

Flaw in Apache HTTP Server 2.4.49 allows path traversal attack for remote code executio

Reporter	Title	Published	Views	Family All 466
GithubExploit	Exploit for Path Traversal in Apache Http_Server	12 Mar 202221:24	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	7 Oct 202112:30	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	7 Oct 202100:14	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	17 Jun 202213:36	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	14 Mar 202204:08	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	31 Mar 202201:48	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	26 Oct 202117:56	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	4 Apr 202222:07	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	18 Mar 202617:59	–	githubexploit
GithubExploit	Exploit for Path Traversal in Apache Http_Server	31 Oct 202510:34	–	githubexploit

NVD

Vulners

Node

apache http_serverMatch2.4.49

Node

fedoraproject fedoraMatch34

fedoraproject fedoraMatch35

Node

oracle instantis_enterprisetrackMatch17.1

oracle instantis_enterprisetrackMatch17.2

oracle instantis_enterprisetrackMatch17.3

Node

netapp cloud_backupMatch-

[
  {
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "Apache HTTP Server 2.4 2.4.49"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2021/10/05/2
packetstormsecurity	www.packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html
openwall	www.openwall.com/lists/oss-security/2021/10/16/1
httpd	www.httpd.apache.org/security/vulnerabilities_24.html
oracle	www.oracle.com/security-alerts/cpujan2022.html
packetstormsecurity	www.packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html
openwall	www.openwall.com/lists/oss-security/2021/10/08/4
lists	www.lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E
lists	www.lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ

Parameter	Position	Path	Description	CWE
traversal	path	/cgi-bin	Path traversal vulnerability in Apache 2.4.49/2.4.50 allowing access to files outside the document root (e.g., /etc/passwd) and potential remote code execution when CGI is enabled.	CWE-22
TARGETURI	path	/cgi-bin	Path traversal vulnerability in Apache 2.4.49/2.4.50 allowing access to files outside the document root (e.g., /etc/passwd) and potential remote code execution when CGI is enabled.	CWE-22
DEPTH	path	/cgi-bin	Path traversal vulnerability in Apache 2.4.49/2.4.50 allowing access to files outside the document root (e.g., /etc/passwd) and potential remote code execution when CGI is enabled.	CWE-22
traversal	path	/cgi-bin	RCE attempt via traversal to /bin/sh when CGI is enabled (CVE-2021-41773/CVE-2021-42013).	CWE-22