← Back

CVE-2024-39884

nvd nist
Published: Jul 4, 2024Modified: Jun 17, 2026

JSON object

Loading...
6.2
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.5 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers.   "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.

Affected (2)

Apache
1 product
Http Server
Netapp
1 product
Ontap Tools
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Http Server
Version 2.4.60
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Ontap Tools
Version 10

References (7)

Source: security@apache.org
Mailing List
Source: security@apache.org
Vendor Advisory
Source: security@apache.org
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.