CVE-2021-30641 Unexpected URL matching with 'MergeSlashes OFF'

🗓️ 10 Jun 2021 07:10:24Reported by apacheType

CVE-2021-30641 Unexpected URL matching with 'MergeSlashes OFF' in Apache HTTP Server 2.4.39-2.4.4

Reporter	Title	Published	Views	Family All 173
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server, which is a required product for IBM Tivoli Network Manager IP Edition (CVE-2020-13938, CVE-2021-30641)	28 Jun 202115:28	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in WebSphere Application Server affect IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise	21 Sep 202109:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it. (CVE-2021-31618, CVE-2020-13950, CVE-2019-17567, CVE-2020-26691, CVE-2021-26690, CVE-2020-13938, CVE-2021-30641, CVE-2020-35452)	29 Apr 202502:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Directory Server	1 Sep 202116:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (CVE-2020-13938, CVE-2021-30641)	14 Sep 202215:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM HTTP Server affect IBM Netezza Performance Portal	7 Oct 202106:28	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM HTTP Server used by WebSphere Application Server shipped with IBM Case Manager (CVE-2020-13938, CVE-2021-30641)	23 Jun 202122:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Remote Server	28 Jun 202118:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities have been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2020-13938, CVE-2021-30641)	12 Aug 202118:25	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Digital Business Automation Workflow family products (CVE-2020-13938, CVE-2021-30641)	14 Sep 202215:28	–	ibm

[
  {
    "product": "Apache HTTP Server",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "2.4.46"
      },
      {
        "status": "affected",
        "version": "2.4.43"
      },
      {
        "status": "affected",
        "version": "2.4.41"
      },
      {
        "status": "affected",
        "version": "2.4.39"
      }
    ]
  }
]

Source	Link
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
httpd	www.httpd.apache.org/security/vulnerabilities_24.html
oracle	www.oracle.com/security-alerts/cpuoct2021.html
lists	www.lists.apache.org/thread.html/r2b4773944d83d2799de9fbaeee7fe0f3fd72669467787e02f434cb10%40%3Cannounce.httpd.apache.org%3E
security	www.security.netapp.com/advisory/ntap-20210702-0001/
openwall	www.openwall.com/lists/oss-security/2021/06/10/8
lists	www.lists.debian.org/debian-lts-announce/2021/07/msg00006.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
debian	www.debian.org/security/2021/dsa-4937
lists	www.lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E

20 Oct 2021 10:42Current

7.5High risk

Vulners AI Score7.5

EPSS0.51765