Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Is CVE-2024-38476 exploited?
Not in the CISA KEV catalog.
EPSS puts exploitation in the next 30 days at 42%.
Public exploit code: none found in monitored sources.
Which products and versions are affected?
Dell · PowerScale OneFS · OneFS <9.5.1.1
HCL · Commerce · 9.1.0-9.1.15
F5 · BIG-IP · 15.1.0-15.1.10
HCL · Commerce · 9.0-9.0.1.21
Dell · PowerScale OneFS · OneFS <9.4.0.20
HCL · Commerce · 8.x
Dell · ECS · <3.8.1.3
Xerox · FreeFlow Print Server · <9.0 SP-3 (93.M3.14.86)
IBM · Rational Build Forge · <8.0.0.27
Red Hat · JBoss Core Services · <2.4.62
IBM · Tivoli Monitoring · 6.3.0.7
F5 · BIG-IP · 17.1.0-17.1.1
Xerox · FreeFlow Print Server · v9 for Solaris
Apache · HTTP Server · <2.4.60
IBM · HTTP Server · 8.5
Xerox · FreeFlow Print Server · v9
IBM · Rational ClearQuest · 10.0-10.0.5
F5 · BIG-IP · 16.1.0-16.1.5
IBM · Rational ClearQuest · 9.1-9.1.0.6
SonicWall · SMA · <10.2.1.14-75sv
Is there a patch?
PowerScale OneFS OneFS 9.5.1.1
PowerScale OneFS OneFS 9.4.0.20
ECS 3.8.1.3
FreeFlow Print Server 9.0 SP-3 (93.M3.14.86)
Rational Build Forge 8.0.0.27
JBoss Core Services 2.4.62
HTTP Server 2.4.60
SMA 10.2.1.14-75sv
What PlainSec published about CVE-2024-38476
PlainSec has not published a story about this CVE.