Is CVE-2024-47252 in the CISA KEV catalog?

No. CVE-2024-47252 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2024-47252?

CVE-2024-47252 has a CVSS v3 base score of 7.5 (HIGH).

What is the EPSS score for CVE-2024-47252?

CVE-2024-47252 has an EPSS score of 0.67% (48th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2024-47252?

Upgrade apache2 on debian 11 to 2.4.65-1~deb11u1 or later. Fixes are available for 109 affected products.

CVE & CISA-KEV Catalog

CVE-2024-47252

HIGH

7.5

CVSS v3

NVD

Description

Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.

CWE-150

How to fix

Remediation Available

apache2Debian

Fixed in:2.4.65-1~deb11u1CVE-2024-47252

Fixed in:2.4.65-1~deb12u1CVE-2024-47252

Fixed in:2.4.64-1CVE-2024-47252

httpdRocky

Fixed in:0:2.4.63-1.el10_0.2RHSA-2025:15095

Fixed in:0:2.4.6-99.el7_9.6.ppc64RHSA-2025:14997

Fixed in:0:2.4.6-99.el7_9.6RHSA-2025:14997

Fixed in:0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.ppc64le::httpd:2.4RHSA-2025:15619

Fixed in:0:2.4.37-47.module+el8.6.0+23463+5d5709c6.11.s390x::httpd:2.4RHSA-2025:15698

Fixed in:0:2.4.37-39.module+el8.4.0+23462+1fa78ba3.10.src::httpd:2.4RHSA-2025:15684

Fixed in:0:2.4.37-65.module+el8.10.0+23369+11a81384.5.aarch64::httpd:2.4RHSA-2025:15123

Fixed in:0:2.4.37-39.module+el8.4.0+23462+1fa78ba3.10.x86_64::httpd:2.4RHSA-2025:15684

Fixed in:0:2.4.37-47.module+el8.6.0+23463+5d5709c6.11.ppc64le::httpd:2.4RHSA-2025:15698

Fixed in:0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.src::httpd:2.4RHSA-2025:15619

Fixed in:0:2.4.37-56.module+el8.8.0+23464+a2e0c444.10.x86_64::httpd:2.4RHSA-2025:15619

Fixed in:0:2.4.37-47.module+el8.6.0+23463+5d5709c6.11.aarch64::httpd:2.4RHSA-2025:15698

Fixed in:0:2.4.37-65.module+el8.10.0+23369+11a81384.5.s390x::httpd:2.4RHSA-2025:15123

Fixed in:0:2.4.37-47.module+el8.6.0+23463+5d5709c6.11.x86_64::httpd:2.4RHSA-2025:15698

Fixed in:0:2.4.37-47.module+el8.6.0+23463+5d5709c6.11.src::httpd:2.4RHSA-2025:15698

Fixed in:0:2.4.37-65.module+el8.10.0+23369+11a81384.5.x86_64::httpd:2.4RHSA-2025:15123

Fixed in:0:2.4.37-21.module+el8.2.0+23461+1d03af5c.10.src::httpd:2.4RHSA-2025:15516

Fixed in:0:2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64::httpd:2.4RHSA-2025:15516

Fixed in:0:2.4.37-65.module+el8.10.0+23369+11a81384.5.src::httpd:2.4RHSA-2025:15123

Fixed in:0:2.4.37-65.module+el8.10.0+23369+11a81384.5.ppc64le::httpd:2.4RHSA-2025:15123

Fixed in:0:2.4.53-11.el9_2.13RHSA-2025:14902

Fixed in:0:2.4.62-4.el9_6.4RHSA-2025:15023

Fixed in:0:2.4.53-11.el9_2.13RHSA-2025:14902

Fixed in:0:2.4.57-11.el9_4.3RHSA-2025:14903

Fixed in:0:2.4.53-11.el9_2.13RHSA-2025:14902

Fixed in:0:2.4.57-11.el9_4.3RHSA-2025:14903

Fixed in:0:2.4.51-7.el9_0.10RHSA-2025:14901

Fixed in:0:2.4.62-4.el9_6.4RHSA-2025:15023

Fixed in:0:2.4.57-11.el9_4.3RHSA-2025:14903

Fixed in:0:2.4.51-7.el9_0.10RHSA-2025:14901

Fixed in:0:2.4.53-11.el9_2.13RHSA-2025:14902

Fixed in:0:2.4.51-7.el9_0.10RHSA-2025:14901

Fixed in:0:2.4.62-4.el9_6.4RHSA-2025:15023

httpdRed Hat / RHEL