High severity7.5NVD Advisory· Published Jul 18, 2024· Updated Jun 17, 2026

CVE-2024-40898

Description

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests.

Users are recommended to upgrade to version 2.4.62 which fixes this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/HTTP Server3 versions
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*range: <2.4.62
- (no CPE)range: >=2.4.62
- (no CPE)range: 2.4.0
osv-coords2 versions
pkg:bitnami/apache pkg:rpm/opensuse/apache2&distro=openSUSE%20Tumbleweed
>= 2.4.0, < 2.4.62+ 1 more
- (no CPE)range: >= 2.4.0, < 2.4.62
- (no CPE)range: < 2.4.62-1.1

Patches

Vulnerability mechanics

References

httpd.apache.org/security/vulnerabilities_24.htmlnvdVendor Advisory
www.openwall.com/lists/oss-security/2024/07/17/7nvd
security.netapp.com/advisory/ntap-20240808-0006/nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000