CVE-2021-40438

Katalog CVE

CVSS 9.0 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 100,0%

Kerentanan Server-Side Request Forgery (SSRF) pada resf rocky linux, redhat enterprise linux +21 lainnya. Skor CVSS 3.1 9.0 (Critical) menurut NVD. Masuk katalog KEV CISA pada 1 Desember 2021, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

Rincian

Terbit di NVD

16 September 2021

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

9.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apache HTTP Server-Side Request Forgery (SSRF)

Masuk KEV

1 Desember 2021

Tenggat CISA

15 Desember 2021 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 83 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://httpd.apache.org/security/vulnerabilities_24.html release notes · advisory vendor
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40438 pemerintah AS
• https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-20 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211008-0004/ advisory pihak ketiga
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-2.4.49-VWL69sWQ broken link · advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4982 mailing list · advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-17 advisory pihak ketiga
• https://lists.apache.org/thread.html/r210807d0bb55f4aa6fbe1512be6bcc4dacd64e84940429fba329967a%40%3Cusers.http... mailing list
• https://lists.apache.org/thread.html/r2eb200ac1340f69aa22af61ab34780c531d110437910cb9c0ece3b37%40%3Cbugs.httpd... mailing list
• https://lists.apache.org/thread.html/r3925e167d5eb1c75def3750c155d753064e1d34a143028bb32910432%40%3Cusers.http... mailing list
• https://lists.apache.org/thread.html/r61fdbfc26ab170f4e6492ef3bd5197c20b862ce156e9d5a54d4b899c%40%3Cusers.http... mailing list
• https://lists.apache.org/thread.html/r82838efc5fa6fc4c73986399c9b71573589f78b31846aff5bd9b1697%40%3Cusers.http... mailing list
• https://lists.apache.org/thread.html/r82c077663f9759c7df5a6656f925b3ee4f55fcd33c889ba7cd687029%40%3Cusers.http... mailing list
• https://lists.apache.org/thread.html/rf6954e60b1c8e480678ce3d02f61b8a788997785652e9557a3265c00%40%3Cusers.http... mailing list
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNAC... release notes
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36F... release notes