Staging Environment: Content and features may be unstable or change without notice.
Advisory details: apache_httpd / CVE-2021-40438
Advisory ID apache_httpd/CVE-2021-40438
Aliases
Summary A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-918 Server-Side Request Forgery (SSRF)
System Score Found at
apache_httpd important
Reference id Reference type URL
CVE-2021-40438 https://httpd.apache.org/security/json/CVE-2021-40438.json
Data source KEV
Date added Dec. 1, 2021
Description A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Required action Apply updates per vendor instructions.
Due date Dec. 15, 2021
Note 
https://nvd.nist.gov/vuln/detail/CVE-2021-40438
Ransomware campaign use Known

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:08:29Z/

Decision: Attend

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2021/40xxx/CVE-2021-40438.json

Source Advisory: vulnrichment/CVE-2021-40438

View SSVC decision tree 
[{'Exploitation': 'active'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]