The version of Apache httpd installed on the remote host is 2.4.49. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.50 advisory.

  - While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request     processing, allowing an external source to DoS the server. This requires a specially crafted request. The     vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.
    (CVE-2021-41524)

  - A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could     use a path traversal attack to map URLs to files outside the expected document root. If files outside of     the document root are not protected by require all denied these requests can succeed. Additionally this     flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in     the wild. This issue only affects Apache 2.4.49 and not earlier versions. (CVE-2021-41773)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

Apache 2.4.49 < 2.4.50 Multiple Vulnerabilities

high Nessus Plugin ID 153884

Version 1.17