CVE-2021-40438

CriticalKnown Exploited

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects…

apache·CWE-918·Published 2021-09-16

CVSS

9.0

EPSS

1.00

KEV

Yes

Exploits

Vendor statements (5)

cve.orgen

175 chars

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

NVDes

194 chars

Un uri-path diseñado puede causar que mod_proxy reenvíe la petición a un servidor de origen elegido por el usuario remoto. Este problema afecta a Apache HTTP Server versiones 2.4.48 y anteriores

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P
3.1	Primary	cve.org	9.0	—	—	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
3.1	Primary	cve.org	9.0	—	—	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
3.1	Primary	NVD	9.0	2.2	6.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
3.1	Secondary	NVD	9.0	2.2	6.0	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H