NetSight
IP …
critical9.0Known exploited

CVE-2021-40438

Apache HTTP Server-Side Request Forgery (SSRF)

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-12-01. Federal due date: 2021-12-15.

Apply updates per vendor instructions.

Impact

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Affected products

VendorProductAffected versions
ResfRocky Linux
Version 8.0
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Eus
Versions 8.1, 8.2, 8.4, 8.6, 8.8
RedhatEnterprise Linux For Arm 64
Version 8.0
RedhatEnterprise Linux For Arm 64 Eus
Versions 8.6, 8.8
RedhatEnterprise Linux For Ibm Z Systems
Versions 7.0_s390x, 8.0
RedhatEnterprise Linux For Ibm Z Systems Eus
Versions 8.1, 8.4, 8.8
RedhatEnterprise Linux For Ibm Z Systems Eus S390x
Version 8.2
RedhatEnterprise Linux For Power Big Endian
Version 7.0
RedhatEnterprise Linux For Power Little Endian
Versions 7.0, 8.0
RedhatEnterprise Linux For Power Little Endian Eus
Versions 8.1, 8.2, 8.4, 8.6, 8.8
RedhatEnterprise Linux For Scientific Computing
Version 7.0

Weakness classification

CWE-918

References