CVE-2024-38473

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.59 and earlier

Description The issue is related to an encoding problem in the mod proxy component of the Apache HTTP Server, which can allow an attacker to send request URLs with incorrect encoding to backend services, potentially bypassing authentication via crafted requests. This could enable a remote attacker to access confidential data and cause a denial of service.

Recommendations For Apache HTTP Server versions 2.4.59 and earlier, upgrade to version 2.4.60, which fixes this issue.