CVE-2024-38474: http server Improper Encoding — Fix

Description

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

Is your site exposed to CVE-2024-38474?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-116 CWE-116

Affected Products

Vendor	Product	Versions
apache	http_server	2.4.0 — 2.4.60
netapp	clustered_data_ontap	All

References

Advisories & Patches

https://httpd.apache.org/security/vulnerabilities_24.html https://httpd.apache.org/security/vulnerabilities_24.html

Other References

https://security.netapp.com/advisory/ntap-20240712-0001/ http://www.openwall.com/lists/oss-security/2024/07/01/7 https://security.netapp.com/advisory/ntap-20240712-0001/

Frequently Asked Questions

What is CVE-2024-38474? +

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2024-38474? +

CVE-2024-38474 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-38474? +

CVE-2024-38474 affects products from apache, netapp, specifically: clustered_data_ontap, http_server. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-38474? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-50642

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences …

CVE-2026-44588

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via …

CVE-2026-71869

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression …

CVE-2025-1308

A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.

CVE-2025-34141

A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability requires …

CVE-2026-45570

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs …

CVE-2024-38474