QID 87465

Date Published: 2021-10-06

QID 87465: Apache Hypertext Transfer Protocol Server (HTTP Server) Path Traversal and Null Pointer Dereference Vulnerabilities

Apache HTTP Server is an HTTP web server application.

CVEs' and the type of vulnerabilities related to this are:
CVE-2021-41773: Path Traversal and File Disclosure vulnerability
CVE-2021-41524: Null Pointer Dereference Vulnerability

Affected Versions:
Apache Server version 2.4.49 only.
QID Detections Logic:
The QID sends a crafted GET request to see if the contents of /etc/passwd are revealed in the response.

An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts.

The Null Pointer Dereference Vulnerability could allow an external attacker to perform Denial of Service (DoS) attack on the target Apache server

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 4.3 severity.

Solution

Customers are advised to update to Apache HTTP Server 2.4.50. For more information refer to Apache HTTP Server

Vendor References

Apache HTTP Server - httpd.apache.org/security/vulnerabilities_24.html

CVEs related to QID 87465

CVE-2021-41773 | CVE-2021-41524 |

Software Advisories

Advisory ID	Software	Component	Link
Apache HTTP Server			httpd.apache.org/download.cgi

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].