Detections
Analytics

Apache HTTP Server 2.4.49 Path Traversal (CVE-2021-41773)

high Nessus Plugin ID 153885

Language:

Synopsis

The remote web server is affected by a path traversal vulnerability.

Description

The instance of Apache HTTP Server running on the remote host is affected by a path traversal vulnerability. A remote, unauthenticated attacker can exploit this issue, via a specially crafted HTTP request, to access arbitrary files on the remote host.

Solution

Upgrade to Apache HTTP Server version 2.4.50 or later.

See Also

https://httpd.apache.org/security/vulnerabilities_24.html

Plugin Details

Severity: High

ID: 153885

File Name: apache_2_4_49_path_traversal.nbin

Version: 1.53

Type: remote

Family: CGI abuses

Published: 10/5/2021

Updated: 4/23/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-41773

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:apache:http_server, cpe:/a:apache:httpd

Required KB Items: installed_sw/Apache

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/4/2021

Vulnerability Publication Date: 10/4/2021

CISA Known Exploited Vulnerability Due Dates: 11/17/2021

Exploitable With

CANVAS (CANVAS)

Metasploit (Apache 2.4.49/2.4.50 Traversal RCE)

Reference Information

CVE: CVE-2021-41773

IAVA: 2021-A-0451-S