1. Home
  2. Mapping Frameworks
  3. Known Exploited Vulnerabilities Home
  4. Apache HTTP Server Improper Escaping of Output Vulnerability

Known Exploited Vulnerabilities CVE-2024-38475

Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability exploitation_technique T1190 Exploit Public-Facing Application
Comments
Improper escaping in Apache HTTP Server versions 2.4.59 and before permits code execution or disclosure of source code, as well as session hijacking and a potential full system compromise. An attacker can use a crafted URL to perform a traversal attack to trick the Apache server into reading sensitive files.
References
  1. https://github.com/p0in7s/CVE-2024-38475
CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability primary_impact T1059 Command and Scripting Interpreter
Comments
Improper escaping in Apache HTTP Server versions 2.4.59 and before permits code execution or disclosure of source code, as well as session hijacking and a potential full system compromise. An attacker can use a crafted URL to perform a traversal attack to trick the Apache server into reading sensitive files.
References
  1. https://github.com/p0in7s/CVE-2024-38475
CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability primary_impact T1528 Steal Application Access Token
Comments
Improper escaping in Apache HTTP Server versions 2.4.59 and before permits code execution or disclosure of source code, as well as session hijacking and a potential full system compromise. An attacker can use a crafted URL to perform a traversal attack to trick the Apache server into reading sensitive files.
References
  1. https://github.com/p0in7s/CVE-2024-38475
CVE-2024-38475 Apache HTTP Server Improper Escaping of Output Vulnerability primary_impact T1005 Data from Local System
Comments
Improper escaping in Apache HTTP Server versions 2.4.59 and before permits code execution or disclosure of source code, as well as session hijacking and a potential full system compromise. An attacker can use a crafted URL to perform a traversal attack to trick the Apache server into reading sensitive files.
References
  1. https://github.com/p0in7s/CVE-2024-38475