According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.62. It is, therefore, affected by multiple vulnerabilities:

 - A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. (CVE-2024-40725)

 - SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests. (CVE-2024-40898) Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-40898 advisory.

  - SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak     NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to     version 2.4.62 which fixes this issue. (CVE-2024-40898)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2024 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform (curl)). The supported version that is affected is     21.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols     to compromise Oracle Essbase. Successful attacks require human interaction from a person other than the attacker.     Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Oracle Essbase. (CVE-2024-7264)

  - Security-in-Depth issue in Oracle Essbase (component: Essbase Web Platform (Apache Xerces-C++)). (CVE-2024-23807)

  - Security-in-Depth issue in Oracle Essbase (component: Essbase Web Platform (OpenSSL)). (CVE-2024-2511)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202409-31 (Apache HTTPD: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache HTTPD. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache httpd installed on the remote host is prior to 2.4.62. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.62 advisory.

  - SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak     NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to     version 2.4.62 which fixes this issue. (CVE-2024-40898)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.62. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-200-01 advisory.

    New httpd packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is 6.2.1, 6.3.0 or 6.4.0.
It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-13 advisory.

  - Security Center leverages third-party software to help provide underlying functionality. Several of the     third-party components (Apache, libcurl) were found to contain vulnerabilities, and updated versions have     been made available by the providers.Out of caution and in line with best practice, Tenable has opted to     upgrade these components to address the potential impact of the issues. Security Center Patch SC-202408.1     updates Apache to version 2.4.62 and libcurl to version 8.8.0 to address the identified vulnerabilities.
    Tenable has released Security Center Patch SC-202408.1 to address these issues. The installation files can     be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/security-center     (CVE-2024-2004, CVE-2024-2379, CVE-2024-2398, CVE-2024-2466, CVE-2024-36387, CVE-2024-38472,     CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476, CVE-2024-38477, CVE-2024-39573,     CVE-2024-39884, CVE-2024-40725, CVE-2024-40898, CVE-2024-6197, CVE-2024-6874)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the httpd package has been released.

ID	Name	Product	Family	Published	Updated	Severity
114385	Apache 2.4.x < 2.4.62 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/22/2024	7/22/2024	high
204815	CBL Mariner 2.0 Security Update: httpd (CVE-2024-40898)	Nessus	MarinerOS Local Security Checks	7/27/2024	8/9/2024	high
209277	Oracle Essbase Multiple Vulnerabilities (October 2024 CPU)	Nessus	Misc.	10/18/2024	10/21/2024	high
207890	GLSA-202409-31 : Apache HTTPD: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	9/28/2024	9/28/2024	critical
210450	Apache 2.4.x < 2.4.62 Multiple Vulnerabilities (Windows)	Nessus	Web Servers	11/6/2024	11/6/2024	high
202636	Slackware Linux 15.0 / current httpd Multiple Vulnerabilities (SSA:2024-200-01)	Nessus	Slackware Local Security Checks	7/18/2024	8/9/2024	high
205527	Tenable Security Center Multiple Vulnerabilities (TNS-2024-13)	Nessus	Misc.	8/14/2024	9/4/2024	critical
204763	Photon OS 4.0: Httpd PHSA-2024-4.0-0659	Nessus	PhotonOS Local Security Checks	7/26/2024	8/20/2024	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

high

critical

high