Apache HTTP Server: HTTP Response Splitting in multiple modules
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.3epss 2.9%
probabilidad de explotación
2.9%top 15% de las CVE
explotación observada
noninguna fuente lo reporta
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.
Users are recommended to upgrade to version 2.4.59, which fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Productos afectados
Apache Software Foundation · Apache HTTP ServerReferencias
http://seclists.org/fulldisclosure/2024/Jul/18https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.debian.org/debian-lts-announce/2024/05/msg00013.htmlhttps://lists.debian.org/debian-lts-announce/2024/05/msg00014.htmlhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2N2NZEX3MR64IWSGL3QGN7KSRUGAEMF/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX5U34KYGDYPRH3AJ6MDDCBJDWDPXNVJ/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNV4SZAPVS43DZWNFU7XBYYOZEZMI4ZC/https://security.netapp.com/advisory/ntap-20240415-0013/https://support.apple.com/kb/HT214119http://www.openwall.com/lists/oss-security/2024/04/04/5