CVE-2021-42013

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 100,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada apache http server, fedoraproject fedora +4 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Rincian

Terbit di NVD

7 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

100,0% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apache HTTP Server Path Traversal Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

17 November 2021 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://httpd.apache.org/security/vulnerabilities_24.html release notes · advisory vendor
• https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.... mailing list · patch
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2022.html patch · advisory pihak ketiga
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013 pemerintah AS
• http://jvn.jp/en/jp/JVN51106450/index.html advisory pihak ketiga
• http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://www.openwall.com/lists/oss-security/2021/10/07/6 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/2 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/4 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/5 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/08/6 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/09/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/11/4 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/15/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/10/16/1 mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-20 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20211029-0009/ advisory pihak ketiga