CVE-2024-40898

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.Users are recommended to upgrade to version 2.4.62 which fixes this issue.

Affected

Apache Software Foundation · Apache HTTP Server

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 CNA

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

1.54% chance of exploitation in the next 30 days, 74th percentile

Published

2024-07-18

Updated

2024-09-13

Proof-of-concept exploits (3)

• TAM-K592/CVE-2024-40725-CVE-2024-4089887★ · 2024-07-19
• anilpatel199n/CVE-2024-408981★ · 2025-06-14
• ForceEA001/CVE-2024-40898-SSL-Bypass-Detection2★ · 2025-06-30

Security advisories

• https://httpd.apache.org/security/vulnerabilities_24.html

References

• CVE Record
• NVD entry

Related

• CVE-2024-40725
• CVE-2024-4577
• CVE-2024-52316
• CVE-2024-52317
• CVE-2024-52318
• CVE-2024-53677