Is CVE-2024-38474 in the CISA KEV catalog?

No. CVE-2024-38474 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2024-38474?

CVE-2024-38474 has a CVSS v3 base score of 9.8 (CRITICAL).

What is the EPSS score for CVE-2024-38474?

CVE-2024-38474 has an EPSS score of 2.46% (82th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2024-38474?

Upgrade apache2 on debian 11 to 2.4.61-1~deb11u1 or later. Fixes are available for 109 affected products.

CVE & CISA-KEV Catalog

CVE-2024-38474

CRITICALEPSS 82th pctl

9.8

CVSS v3

NVD

Description

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

CWE-116

How to fix

Remediation Available

apache2Debian

Fixed in:2.4.61-1~deb11u1CVE-2024-38474

Fixed in:2.4.61-1~deb12u1CVE-2024-38474

Fixed in:2.4.60-1CVE-2024-38474

httpdRocky

Fixed in:0:2.4.6-99.el7_9.2RHSA-2024:4943

Fixed in:0:2.4.6-99.el7_9.2.ppc64RHSA-2024:4943

Fixed in:0:2.4.6-99.el7_9.2RHSA-2024:4943

Fixed in:0:2.4.6-90.el7_7.4RHSA-2024:4938

Fixed in:0:2.4.6-99.el7_9.2RHSA-2024:4943

Fixed in:0:2.4.6-90.el7_7.4RHSA-2024:4938

Fixed in:0:2.4.37-56.module+el8.8.0+22079+e03f6970.8.s390x::httpd:2.4RHSA-2024:4719

Fixed in:0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1.ppc64le::httpd:2.4RHSA-2024:4720

Fixed in:0:2.4.37-47.module+el8.6.0+22124+21ed7001.9.x86_64::httpd:2.4RHSA-2024:4827

Fixed in:0:2.4.37-39.module+el8.4.0+22127+467cc488.8.x86_64::httpd:2.4RHSA-2024:4830

Fixed in:0:2.4.37-47.module+el8.6.0+22124+21ed7001.9.ppc64le::httpd:2.4RHSA-2024:4827

Fixed in:0:2.4.37-56.module+el8.8.0+22079+e03f6970.8.aarch64::httpd:2.4RHSA-2024:4719

Fixed in:0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1.s390x::httpd:2.4RHSA-2024:4720

Fixed in:0:2.4.37-39.module+el8.4.0+22127+467cc488.8.src::httpd:2.4RHSA-2024:4830

Fixed in:0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64::httpd:2.4RHSA-2024:4820

Fixed in:0:2.4.37-56.module+el8.8.0+22079+e03f6970.8.ppc64le::httpd:2.4RHSA-2024:4719

Fixed in:0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8.src::httpd:2.4RHSA-2024:4820

Fixed in:0:2.4.37-47.module+el8.6.0+22124+21ed7001.9.src::httpd:2.4RHSA-2024:4827

Fixed in:0:2.4.37-47.module+el8.6.0+22124+21ed7001.9.aarch64::httpd:2.4RHSA-2024:4827

Fixed in:0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1.src::httpd:2.4RHSA-2024:4720

Fixed in:0:2.4.37-47.module+el8.6.0+22124+21ed7001.9.s390x::httpd:2.4RHSA-2024:4827

Fixed in:0:2.4.37-56.module+el8.8.0+22079+e03f6970.8.src::httpd:2.4RHSA-2024:4719

Fixed in:0:2.4.37-56.module+el8.8.0+22079+e03f6970.8.x86_64::httpd:2.4RHSA-2024:4719

Fixed in:0:2.4.37-39.module+el8.4.0+22127+467cc488.8.ppc64le::httpd:2.4RHSA-2024:4830

Fixed in:0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1.x86_64::httpd:2.4RHSA-2024:4720

Fixed in:0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1.aarch64::httpd:2.4RHSA-2024:4720

Fixed in:0:2.4.53-11.el9_2.8RHSA-2024:4862

Fixed in:0:2.4.51-7.el9_0.7RHSA-2024:4863

Fixed in:0:2.4.57-11.el9_4RHSA-2024:4726

Fixed in:0:2.4.53-11.el9_2.8RHSA-2024:4862

Fixed in:0:2.4.51-7.el9_0.7RHSA-2024:4863

Fixed in:0:2.4.53-11.el9_2.8RHSA-2024:4862

Fixed in:0:2.4.51-7.el9_0.7RHSA-2024:4863

httpdRed Hat / RHEL