CVE-2024-38474

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.59 and earlier

Description The issue is related to a substitution encoding problem in the mod rewrite module of the Apache HTTP Server, allowing an attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL, or disclose the source of scripts meant to be executed as CGI.

Recommendations For Apache HTTP Server versions 2.4.59 and earlier, upgrade to version 2.4.60, which fixes this issue. As a temporary workaround, consider specifying the rewrite flag "UnsafeAllow3F" for RewriteRules that capture and substitute unsafely to prevent them from failing.