Remote code execution vulnerability was found in Apache HTTP Server. Malicious users can exploit this vulnerability to execute arbitrary code and obtain sensitive information.

Exploitation:

Public exploits exist for this vulnerability.

Affected products:

Apache HTTP Server earlier than 2.4.51

Solution:

Update to the latest version
Download Apache HTTP Server

Original advisories:

Fixed in Apache HTTP Server 2.4.51

Impacts:

ACE

Related products:

Apache HTTP Server

CVE-IDS:

CVE-2021-420139.8Critical

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42013

httpd.apache.org/download.cgi

httpd.apache.org/security/vulnerabilities_24.html#2.4.51

statistics.securelist.com/vulnerability-scan/month

threats.kaspersky.com/en/class/Exploit/

threats.kaspersky.com/en/product/Apache-HTTP-Server/

veracode 1

githubexploit 30

dsquare 2

zdt 5

packetstorm 4

altlinux 2

openvas 9

hackerone 3

nessus 6

exploitdb 3

prion 2

alpinelinux 2

fedora 2

rapid7blog 2

thn 2

freebsd 1

cisa 2

debiancve 2

cve 2

osv 4

metasploit 2

cvelist 2

ubuntucve 2

cisa_kev 2

ibm 1

httpd 1

nuclei 2

checkpoint_advisories 1

attackerkb 3

f5 1

redhatcve 1

jvn 1

mageia 1

slackware 1

qualysblog 3

impervablog 1

malwarebytes 1

photon 2

cisco 1

trellix 2

amazon 2

gentoo 1

ics 2

mmpc 1

mssecure 1

oracle 2

veracode

Path Traversal

2021-10-08 21:08:53

githubexploit

Exploit for CVE-2021-42013

2021-10-20 15:32:39

Exploit for CVE-2021-42013

2022-09-15 12:15:00

Exploit for CVE-2021-42013

2024-04-07 16:04:06

dsquare

Apache 2.4.50 RCE

2021-10-08 00:00:00

Apache 2.4.50 Path Traversal

2021-10-08 00:00:00

zdt

Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution Vulnerabilities

2021-10-13 00:00:00

Apache 2.4.50 Remote Code Execution Exploit

2022-06-07 00:00:00

Apache HTTP Server 2.4.50 - Remote Code Execution Exploit (2)

2021-10-25 00:00:00

packetstorm

Apache HTTP Server 2.4.50 Remote Code Execution

2021-10-24 00:00:00

Apache HTTP Server 2.4.50 Path Traversal / Code Execution

2021-10-13 00:00:00

Apache 2.4.49 / 2.4.50 Traversal / Remote Code Execution

2021-10-25 00:00:00

altlinux

Security fix for the ALT Linux 9 package apache2 version 1:2.4.51-alt1

2021-10-13 00:00:00

Security fix for the ALT Linux 10 package apache2 version 1:2.4.51-alt1

2021-10-11 00:00:00

openvas

Apache HTTP Server 2.4.49 - 2.4.50 Directory Traversal / RCE Vulnerability - Active Check

2021-10-08 00:00:00

Slackware: Security Advisory (SSA:2021-280-01)

2022-04-21 00:00:00

Mageia: Security Advisory (MGASA-2021-0470)

2022-01-28 00:00:00

hackerone

Internet Bug Bounty: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.50

2021-11-18 21:56:01

Internet Bug Bounty: Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

2021-11-08 21:47:54

Internet Bug Bounty: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)

2021-11-14 23:54:06

nessus

Apache HTTP Server 2.4.49 & 2.4.50 Path Traversal (CVE-2021-42013)

2021-11-18 00:00:00

Apache 2.4.49 < 2.4.51 Path Traversal Vulnerability

2021-10-08 00:00:00

FreeBSD : Apache httpd -- Path Traversal and Remote Code Execution (d001c189-2793-11ec-8fb1-206a8a720317)

2021-10-11 00:00:00

exploitdb

Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)

2021-10-13 00:00:00

Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2)

2021-10-25 00:00:00

Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)

2021-11-11 00:00:00

prion

Path traversal

2021-10-05 09:15:00

Path traversal

2021-10-07 16:15:00

alpinelinux

CVE-2021-41773

2021-10-05 09:15:00

CVE-2021-42013

2021-10-07 16:15:00

fedora

[SECURITY] Fedora 34 Update: httpd-2.4.51-1.fc34

2021-10-12 23:46:03

[SECURITY] Fedora 35 Update: httpd-2.4.51-2.fc35

2021-10-15 00:50:08

rapid7blog

Apache HTTP Server CVE-2021-41773 Exploited in the Wild

2021-10-06 16:42:32

Metasploit Wrap-Up

2021-10-29 17:59:46

thn

New Patch Released for Actively Exploited 0-Day Apache Path Traversal to RCE Attacks

2021-10-08 04:47:00

Zerobot Botnet Emerges as a Growing Threat with New Exploits and Capabilities

2022-12-22 09:39:00

freebsd

Apache httpd -- Path Traversal and Remote Code Execution

2021-10-07 00:00:00

cisa

Apache Releases Security Update for Apache HTTP Server

2021-10-06 00:00:00

Apache Releases HTTP Server version 2.4.51 to Address Vulnerabilities Under Exploitation

2021-10-07 00:00:00

debiancve

CVE-2021-41773

2021-10-05 09:15:00

CVE-2021-42013

2021-10-07 16:15:00

cve

CVE-2021-42013

2021-10-07 16:15:00

CVE-2021-41773

2021-10-05 09:15:00

osv

BIT-apache-2021-42013

2024-03-06 10:54:27

CVE-2021-41773

2021-10-05 09:15:00

CVE-2021-42013

2021-10-07 16:15:09

metasploit

Apache 2.4.49/2.4.50 Traversal RCE scanner

2021-10-06 17:00:59

Apache 2.4.49/2.4.50 Traversal RCE

2021-10-08 11:22:47

cvelist

CVE-2021-42013 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

2021-10-07 15:50:14

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

2021-10-05 08:40:12

ubuntucve

CVE-2021-42013

2021-10-07 00:00:00

CVE-2021-41773

2021-10-05 00:00:00

cisa_kev

Apache HTTP Server Path Traversal Vulnerability

2021-11-03 00:00:00

Apache HTTP Server Path Traversal Vulnerability

2021-11-03 00:00:00

ibm

Security Bulletin: IBM Rational Build Forge 8.0.x is affected by Apache HTTP Server version used in it. (CVE-2021-42013)

2022-01-17 18:38:24

httpd

Apache Httpd < 2.4.51 : Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

2021-10-06 00:00:00

nuclei

Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution

2021-10-07 18:17:29

Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution

2021-10-07 18:17:29

checkpoint_advisories

Apache HTTP Server Directory Traversal (CVE-2021-41773; CVE-2021-42013)

2021-10-06 00:00:00

attackerkb

Apache HTTPd 2.4.49/2.4.50 路径穿越漏洞

2021-10-11 00:00:00

CVE-2021-41773

2021-10-05 00:00:00

CVE-2021-42013: Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)

2021-10-08 00:00:00

K04082144 : Apache HTTP Server vulnerability CVE-2021-41773, CVE-2021-42013

2021-10-21 00:00:00

redhatcve

CVE-2021-42013

2021-10-07 17:33:09

jvn

JVN#51106450: Apache HTTP Server vulnerable to directory traversal

2021-10-08 00:00:00

mageia

Updated apache packages fix security vulnerability

2021-10-08 22:12:12

slackware

[slackware-security] httpd

2021-10-08 03:27:06

qualysblog

Apache HTTP Server Path Traversal & Remote Code Execution (CVE-2021-41773 & CVE-2021-42013)

2021-10-28 06:22:22

Qualys Response to CISA Alert: Binding Operational Directive 22-01

2021-11-09 06:15:01

Managing CISA Known Exploited Vulnerabilities with Qualys VMDR

2022-02-23 05:39:00

impervablog

How RASP Protects Apache Servers from zero-day Path Traversal Attacks (CVE-2021-41773)

2021-10-26 19:35:24

malwarebytes

[Updated, again] Apache fixes zero-day vulnerability in HTTP Server

2021-10-06 14:23:08

photon

Critical Photon OS Security Update - PHSA-2021-0118

2021-10-19 00:00:00

Critical Photon OS Security Update - PHSA-2021-4.0-0118

2021-10-20 00:00:00

cisco

Apache HTTP Server Vulnerabilities: October 2021

2021-10-07 16:00:00

trellix

The Bug Report – October Edition

2021-11-02 00:00:00

The Bug Report – October Edition

2021-11-02 00:00:00

amazon

Important: httpd

2021-10-15 07:57:00

Important: httpd24

2021-10-15 07:52:00

gentoo

Apache HTTPD: Multiple Vulnerabilities

2022-08-14 00:00:00

ics

Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors

2022-10-06 12:00:00

2022 Top Routinely Exploited Vulnerabilities

2023-08-03 12:00:00

mmpc

Microsoft research uncovers new Zerobot capabilities

2022-12-21 20:00:00

mssecure

Microsoft research uncovers new Zerobot capabilities

2022-12-21 20:00:00

oracle

Oracle Critical Patch Update Advisory - January 2022

2022-01-18 00:00:00

Oracle Critical Patch Update Advisory - April 2022

2022-04-19 00:00:00

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.974 High

EPSS

Percentile

99.9%

JSON

Related for KLA12372