CVE-2024-40898

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.Users are recommended to upgrade to version 2.4.62 which fixes this issue.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

1.54% chance of exploitation in the next 30 days, 73th percentile

Published

2024-07-18

Updated

2024-09-13

Proof-of-concept exploits (3)

• TAM-K592/CVE-2024-40725-CVE-2024-4089887★ · 2024-07-19
• anilpatel199n/CVE-2024-408981★ · 2025-06-14
• ForceEA001/CVE-2024-40898-SSL-Bypass-Detection

References

• CVE Record
• NVD entry

Related

• CVE-2024-40725
• CVE-2024-4577
• CVE-2024-52316
• CVE-2024-52317
• CVE-2024-52318
• CVE-2024-53677