CISA KEV · Known exploitedCritical

CVE-2024-38475

Apache HTTP Server

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately const...

CVSS: 9.1
EPSS: 100.0%
CISA KEV: Listed
Published: 2024.07.02

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability100.0%

Technical severityCVSS 9.1

Vulnerability overview

Affected product and versions

Product: Apache HTTP Server
Affected versions: 2.4.0, >= 2.4.0 < 2.4.60, < 10.2.1.14-75sv
Fixed versions: 2.4.60, 10.2.1.14-75sv

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Due date: 2025.05.22

1
Identify
Confirm that Apache HTTP Server and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE: CWE-116
KEV added: 2025.05.01
Ransomware use: 미확인