Search for vulnerabilities
Vulnerability details: VCID-pcbt-s3v4-x3ck
Vulnerability ID VCID-pcbt-s3v4-x3ck
Aliases CVE-2024-39884
Summary A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers.   "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-39884.json
epss 0.00131 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00131 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00131 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00131 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00131 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00131 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00148 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00256 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00256 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00256 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00256 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00256 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00256 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00256 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00256 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
epss 0.00256 https://api.first.org/data/v1/epss?cve=CVE-2024-39884
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.2 https://httpd.apache.org/security/vulnerabilities_24.html
ssvc Track https://httpd.apache.org/security/vulnerabilities_24.html
cvssv3.1 6.2 https://security.netapp.com/advisory/ntap-20240712-0002/
ssvc Track https://security.netapp.com/advisory/ntap-20240712-0002/
cvssv3.1 6.2 http://www.openwall.com/lists/oss-security/2024/07/17/6
ssvc Track http://www.openwall.com/lists/oss-security/2024/07/17/6
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-39884.json
https://api.first.org/data/v1/epss?cve=CVE-2024-39884
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39884
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://httpd.apache.org/security/vulnerabilities_24.html
http://www.openwall.com/lists/oss-security/2024/07/03/8
2295761 https://bugzilla.redhat.com/show_bug.cgi?id=2295761
6 http://www.openwall.com/lists/oss-security/2024/07/17/6
cpe:2.3:a:apache:http_server:2.4.60:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:http_server:2.4.60:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*
CVE-2024-39884 https://httpd.apache.org/security/json/CVE-2024-39884.json
CVE-2024-39884 https://nvd.nist.gov/vuln/detail/CVE-2024-39884
ntap-20240712-0002 https://security.netapp.com/advisory/ntap-20240712-0002/
USN-6885-1 https://usn.ubuntu.com/6885-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-39884.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://httpd.apache.org/security/vulnerabilities_24.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-05T13:54:22Z/ Found at https://httpd.apache.org/security/vulnerabilities_24.html
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://security.netapp.com/advisory/ntap-20240712-0002/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-05T13:54:22Z/ Found at https://security.netapp.com/advisory/ntap-20240712-0002/
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://www.openwall.com/lists/oss-security/2024/07/17/6
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-05T13:54:22Z/ Found at http://www.openwall.com/lists/oss-security/2024/07/17/6
Exploit Prediction Scoring System (EPSS)
Percentile 0.33366
EPSS Score 0.00131
Published At Aug. 11, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:29:09.959958+00:00 Apache HTTPD Importer Import https://httpd.apache.org/security/json/CVE-2024-39884.json 37.0.0