A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
https://www.tenable.com/security/tns-2021-17
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.debian.org/security/2021/dsa-4982
https://security.netapp.com/advisory/ntap-20211008-0004/
https://security.gentoo.org/glsa/202208-20
https://lists.debian.org/debian-lts-announce/2021/10/msg00001.html
https://cert-portal.siemens.com/productcert/pdf/ssa-685781.pdf
https://www.edgescan.com/wp-content/uploads/2024/03/2023-Vulnerability-Statistics-Report.pdf
https://securityaffairs.com/164838/breaking-news/excobalt-cybercrime-group-targets-russian-orgs.html
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-215a
Published: 2021-09-16
Updated: 2025-05-16
Named Vulnerability: Apache mod_proxy SSRFKnown Exploited Vulnerability (KEV)
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Severity: Medium
Base Score: 9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: Critical
EPSS: 0.94432