CVE-2021-41773

Published: Oct 5, 2021Modified: Jun 17, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

Affected (7)

Products: Apache: Http Server · Fedoraproject: Fedora · Oracle: Instantis Enterprisetrack · +1 more

Show all products

Apache: Http Server · Fedoraproject: Fedora · Oracle: Instantis Enterprisetrack · Netapp: Cloud Backup

1 product

1 product

1 product

Instantis Enterprisetrack

Netapp

1 product

Cloud Backup

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	Version 2.4.49

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 34
Fedoraproject Fedora	Version 35

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Cloud Backup	All versions

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (59)

http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2021/10/05/2

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/07/1

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/07/6

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/08/1

Source: security@apache.org

ExploitMailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/08/2

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/08/3

Source: security@apache.org

ExploitMailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/08/4

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/08/5

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/08/6

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/09/1

Source: security@apache.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/11/4

Source: security@apache.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/15/3

Source: security@apache.org

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2021/10/16/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://httpd.apache.org/security/vulnerabilities_24.html

Source: security@apache.org

Release NotesVendor Advisory

https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Mailing ListPatch

https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E

Source: security@apache.org

Mailing List

https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E

Source: security@apache.org

Mailing List

https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E

Source: security@apache.org

Mailing List

https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E

Source: security@apache.org

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/

Source: security@apache.org

Release Notes

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/

Source: security@apache.org

Release Notes

https://security.gentoo.org/glsa/202208-20

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20211029-0009/

Source: security@apache.org

Third Party Advisory

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: security@apache.org

PatchThird Party Advisory

http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html