CVE-2021-41773

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 100,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada apache http server, fedoraproject fedora +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

Rincian

Terbit di NVD

5 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apache HTTP Server Path Traversal Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

17 November 2021 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://httpd.apache.org/security/vulnerabilities_24.html release notes · advisory vendor
• http://www.openwall.com/lists/oss-security/2021/10/11/4 mailing list · patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/15/3 mailing list · patch · advisory pihak ketiga
• https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.... mailing list · patch
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773 pemerintah AS
• http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.htm... exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://www.openwall.com/lists/oss-security/2021/10/05/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/07/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/07/6 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/1 exploit · mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/3 exploit · mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/4 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/5 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/6 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/09/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/16/1 mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-20 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211029-0009/ advisory pihak ketiga
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ advisory pihak ketiga
• https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.http... mailing list