Detections
Analytics

Apache HTTP Server 2.4.49 & 2.4.50 Path Traversal (CVE-2021-42013)

critical Nessus Plugin ID 155600

Language:

Synopsis

The remote web server is affected by a path traversal vulnerability.

Description

The instance of Apache HTTP Server running on the remote host is affected by a path traversal vulnerability. A remote, unauthenticated attacker can exploit this issue, via a specially crafted HTTP request, to access arbitrary files on the remote host.

Solution

Upgrade to Apache HTTP Server version 2.4.51 or later.

See Also

https://httpd.apache.org/security/vulnerabilities_24.html

Plugin Details

Severity: Critical

ID: 155600

File Name: apache_2_4_50_path_traversal.nbin

Version: 1.68

Type: remote

Family: CGI abuses

Published: 11/18/2021

Updated: 11/22/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-42013

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:http_server, cpe:/a:apache:httpd

Required KB Items: installed_sw/Apache

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/7/2021

Vulnerability Publication Date: 10/7/2021

CISA Known Exploited Vulnerability Due Dates: 11/17/2021

Exploitable With

CANVAS (CANVAS)

Metasploit (Apache 2.4.49/2.4.50 Traversal RCE)

Elliot (Apache 2.4.50 RCE)

Reference Information

CVE: CVE-2021-42013