CVE-2024-39573: exploitation status and patch state
CVE-2024-39573 · CVSS 7.5 HIGH · EPSS 37% · patch available
Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.
Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Is CVE-2024-39573 exploited?
Not in the CISA KEV catalog.
EPSS puts exploitation in the next 30 days at 37%.
Public exploit code: none found in monitored sources.
Which products and versions are affected?
Dell · PowerScale OneFS · OneFS <9.5.1.1
HCL · Commerce · 9.1.0-9.1.15
F5 · BIG-IP · 15.1.0-15.1.10
HCL · Commerce · 9.0-9.0.1.21
Dell · PowerScale OneFS · OneFS <9.4.0.20
HCL · Commerce · 8.x
Dell · ECS · <3.8.1.3
Xerox · FreeFlow Print Server · <9.0 SP-3 (93.M3.14.86)
IBM · Rational Build Forge · <8.0.0.27
Red Hat · JBoss Core Services · <2.4.62
IBM · Tivoli Monitoring · 6.3.0.7
F5 · BIG-IP · 17.1.0-17.1.1
Xerox · FreeFlow Print Server · v9 for Solaris
Apache · HTTP Server · <2.4.60
IBM · HTTP Server · 8.5
Xerox · FreeFlow Print Server · v9
IBM · Rational ClearQuest · 10.0-10.0.5
F5 · BIG-IP · 16.1.0-16.1.5
IBM · Rational ClearQuest · 9.1-9.1.0.6
SonicWall · SMA · <10.2.1.14-75sv
Is there a patch?
PowerScale OneFS OneFS 9.5.1.1
PowerScale OneFS OneFS 9.4.0.20
ECS 3.8.1.3
FreeFlow Print Server 9.0 SP-3 (93.M3.14.86)
Rational Build Forge 8.0.0.27
JBoss Core Services 2.4.62
HTTP Server 2.4.60
SMA 10.2.1.14-75sv
What PlainSec published about CVE-2024-39573
PlainSec has not published a story about this CVE.