{"id":"CVE-2024-38476","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-38476","generatedAt":"2026-11-04T21:48:28.545Z","title":"Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.","description":"Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.\n\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue.","published":"2024-07-01T19:15:05.000Z","lastModified":"2026-06-17T07:40:22.000Z","status":"Modified","sourceIdentifier":"security@apache.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-829"],"affected":["apache/http server","netapp/clustered data ontap"],"epss":{"score":0.41611,"percentile":0.98683,"date":"2026-11-03","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 41.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"],"source":"security@apache.org"},{"url":"https://security.netapp.com/advisory/ntap-20240712-0001/","tags":["Third Party Advisory"],"source":"security@apache.org"},{"url":"http://seclists.org/fulldisclosure/2024/Oct/11","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2024/07/01/9","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240712-0001/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-38476","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}