IM
IronMonkey Threat Research

CVE-2021-40438 CRITICAL

Published: 2021-09-16 | Last Modified: 2026-08-06 | Status: Analyzed

Description

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Additional Descriptions (1)

Un uri-path diseñado puede causar que mod_proxy reenvíe la petición a un servidor de origen elegido por el usuario remoto. Este problema afecta a Apache HTTP Server versiones 2.4.48 y anteriores

CVSS Metrics

Base Score: 9.0 (CRITICAL)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.2

Impact Score: 6.0

Base Score: 6.8 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-918
[email protected] Primary
en CWE-918

Affected Products

Vendor Product Version Update Type
resf rocky_linux 8.0 <built-in method update of dict object at 0x7763d8eaf700> Operating System
redhat enterprise_linux 8.0 <built-in method update of dict object at 0x7763d87a6b00> Operating System
redhat enterprise_linux_eus 8.1 <built-in method update of dict object at 0x7763d8b8af80> Operating System
redhat enterprise_linux_eus 8.2 <built-in method update of dict object at 0x77636c7cad80> Operating System
redhat enterprise_linux_eus 8.4 <built-in method update of dict object at 0x7763d8eac980> Operating System
redhat enterprise_linux_eus 8.6 <built-in method update of dict object at 0x7763d8b89e00> Operating System
redhat enterprise_linux_eus 8.8 <built-in method update of dict object at 0x7763d8edbb40> Operating System
redhat enterprise_linux_for_arm_64 8.0 <built-in method update of dict object at 0x77636c7cbb80> Operating System
redhat enterprise_linux_for_arm_64_eus 8.6 <built-in method update of dict object at 0x7763d8970300> Operating System
redhat enterprise_linux_for_arm_64_eus 8.8 <built-in method update of dict object at 0x7763d8eadf00> Operating System
redhat enterprise_linux_for_ibm_z_systems 7.0_s390x <built-in method update of dict object at 0x77636c7c9300> Operating System
redhat enterprise_linux_for_ibm_z_systems 8.0 <built-in method update of dict object at 0x7763a1162940> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus 8.1 <built-in method update of dict object at 0x7763f05a8340> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus 8.4 <built-in method update of dict object at 0x7763d8d00580> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus 8.8 <built-in method update of dict object at 0x7763f05c7400> Operating System
redhat enterprise_linux_for_ibm_z_systems_eus_s390x 8.2 <built-in method update of dict object at 0x7763d8d00400> Operating System
redhat enterprise_linux_for_power_big_endian 7.0 <built-in method update of dict object at 0x7763d8ed9f00> Operating System
redhat enterprise_linux_for_power_little_endian 7.0 <built-in method update of dict object at 0x77636c7cb680> Operating System
redhat enterprise_linux_for_power_little_endian 8.0 <built-in method update of dict object at 0x7763d8d024c0> Operating System
redhat enterprise_linux_for_power_little_endian_eus 8.1 <built-in method update of dict object at 0x7763d8d02e40> Operating System
redhat enterprise_linux_for_power_little_endian_eus 8.2 <built-in method update of dict object at 0x7763a1163c40> Operating System
redhat enterprise_linux_for_power_little_endian_eus 8.4 <built-in method update of dict object at 0x7763a1126e00> Operating System
redhat enterprise_linux_for_power_little_endian_eus 8.6 <built-in method update of dict object at 0x7763bb098840> Operating System
redhat enterprise_linux_for_power_little_endian_eus 8.8 <built-in method update of dict object at 0x7763d8970900> Operating System
redhat enterprise_linux_for_scientific_computing 7.0 <built-in method update of dict object at 0x7763bb09bb80> Operating System
redhat enterprise_linux_server 7.0 <built-in method update of dict object at 0x7763d8d01380> Operating System
redhat enterprise_linux_server_aus 7.2 <built-in method update of dict object at 0x7763bbafe9c0> Operating System
redhat enterprise_linux_server_aus 7.3 <built-in method update of dict object at 0x7763d8d02940> Operating System
redhat enterprise_linux_server_aus 7.4 <built-in method update of dict object at 0x7763d8d00940> Operating System
redhat enterprise_linux_server_aus 7.6 <built-in method update of dict object at 0x7763d8eaf980> Operating System
redhat enterprise_linux_server_aus 7.7 <built-in method update of dict object at 0x7763bb73ab40> Operating System
redhat enterprise_linux_server_aus 8.2 <built-in method update of dict object at 0x77636c7cb940> Operating System
redhat enterprise_linux_server_aus 8.4 <built-in method update of dict object at 0x7763f0707bc0> Operating System
redhat enterprise_linux_server_aus 8.6 <built-in method update of dict object at 0x7763d8d03b80> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 7.6 <built-in method update of dict object at 0x7763a1162400> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 7.7 <built-in method update of dict object at 0x7763d8d03f40> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 8.1 <built-in method update of dict object at 0x7763d8b89780> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 8.2 <built-in method update of dict object at 0x7763d8d047c0> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 8.4 <built-in method update of dict object at 0x7763d8a21c40> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 8.6 <built-in method update of dict object at 0x7763ba5f1580> Operating System
redhat enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions 8.8 <built-in method update of dict object at 0x77636c7ca400> Operating System
redhat enterprise_linux_server_tus 7.6 <built-in method update of dict object at 0x7763d862b940> Operating System
redhat enterprise_linux_server_tus 7.7 <built-in method update of dict object at 0x7763bbaff2c0> Operating System
redhat enterprise_linux_server_tus 8.2 <built-in method update of dict object at 0x7763a374e540> Operating System
redhat enterprise_linux_server_tus 8.4 <built-in method update of dict object at 0x7763ba5f26c0> Operating System
redhat enterprise_linux_server_tus 8.6 <built-in method update of dict object at 0x7763a1565540> Operating System
redhat enterprise_linux_server_tus 8.8 <built-in method update of dict object at 0x7763bbafecc0> Operating System
redhat enterprise_linux_server_update_services_for_sap_solutions 7.6 <built-in method update of dict object at 0x7763b90df340> Operating System
redhat enterprise_linux_server_update_services_for_sap_solutions 7.7 <built-in method update of dict object at 0x7763a11259c0> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 8.1 <built-in method update of dict object at 0x7763d8b89fc0> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 8.2 <built-in method update of dict object at 0x7763d8b88940> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 8.4 <built-in method update of dict object at 0x7763d8a231c0> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 8.6 <built-in method update of dict object at 0x77635fc2c440> Operating System
redhat enterprise_linux_update_services_for_sap_solutions 8.8 <built-in method update of dict object at 0x7763a3676c40> Operating System
redhat enterprise_linux_workstation 7.0 <built-in method update of dict object at 0x7763a067b380> Operating System
redhat jboss_core_services 1.0 <built-in method update of dict object at 0x7763a374d880> Application
redhat software_collections 1.0 <built-in method update of dict object at 0x7763a067a380> Application
apache http_server * <built-in method update of dict object at 0x7763a0679500> Application
fedoraproject fedora 34 <built-in method update of dict object at 0x7763a0678e80> Operating System
fedoraproject fedora 35 <built-in method update of dict object at 0x7763a067b640> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7763a0679640> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7763a06780c0> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7763a067a300> Operating System
netapp cloud_backup - <built-in method update of dict object at 0x7763ba5f1fc0> Application
netapp clustered_data_ontap - <built-in method update of dict object at 0x7763ba5f1b40> Application
netapp storagegrid - <built-in method update of dict object at 0x7763ba5f2d80> Application
broadcom brocade_fabric_operating_system_firmware - <built-in method update of dict object at 0x7763ba5f3700> Operating System
f5 f5os * <built-in method update of dict object at 0x7763d8631d40> Operating System
f5 f5os * <built-in method update of dict object at 0x7763d8eaebc0> Operating System
oracle enterprise_manager_ops_center 12.4.0.0 <built-in method update of dict object at 0x7763bbbeffc0> Application
oracle http_server 12.2.1.3.0 <built-in method update of dict object at 0x7763bbbec200> Application
oracle http_server 12.2.1.4.0 <built-in method update of dict object at 0x7763bbbec480> Application
oracle instantis_enterprisetrack 17.1 <built-in method update of dict object at 0x7763bbbee580> Application
oracle instantis_enterprisetrack 17.2 <built-in method update of dict object at 0x7763bbbede40> Application
oracle instantis_enterprisetrack 17.3 <built-in method update of dict object at 0x7763bbbef940> Application
oracle secure_global_desktop 5.6 <built-in method update of dict object at 0x7763bbbedf40> Application
oracle zfs_storage_appliance_kit 8.8 <built-in method update of dict object at 0x7763bbbecb80> Application
siemens ruggedcom_nms * <built-in method update of dict object at 0x7763bbbeea00> Application
siemens sinec_nms * <built-in method update of dict object at 0x7763bbbefd80> Application
siemens sinema_remote_connect_server * <built-in method update of dict object at 0x7763bbbef600> Application
siemens sinema_remote_connect_server 3.2 <built-in method update of dict object at 0x7763bbbed300> Application
siemens sinema_server 14.0 <built-in method update of dict object at 0x7763bbbedc00> Application
tenable tenable.sc * <built-in method update of dict object at 0x7763bbbeeb40> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:resf:rocky_linux:8.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus_s390x:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
No cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
No cpe:2.3:o:redhat:enterprise_linux_server_workstation:7.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*
Yes cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:f5:f5os:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:f5:f5os:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:secure_global_desktop:5.6:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:ruggedcom_nms:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:*:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinema_server:14.0:-:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*

References

Notification
Message here