Detections
Analytics

Alpine: multiple apache2 packages: security update to 2.4.62-r0

high Tenable Cloud Security Plugin ID 423666

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy
 content-type based configuration of handlers. "AddType" and similar configuration, under some
 circumstances where files are requested indirectly, result in source code disclosure of local content. For
 example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version
 2.4.62, which fixes this issue. (CVE-2024-40725)

 - SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak
 NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to
 version 2.4.62 which fixes this issue. (CVE-2024-40898)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-40725

https://security.alpinelinux.org/vuln/CVE-2024-40898

Plugin Details

Severity: High

ID: 423666

Version: Revision 1.9

Type: Local

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.7

Percentile: 96.49

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2024-40898

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 7/17/2024

Reference Information

CVE: CVE-2024-40725, CVE-2024-40898

IAVA: 2024-A-0411