In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-apache2 | Apr 2, 2018 | Mar 26, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-httpd24 | May 4, 2018 | Mar 23, 2018 |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Mar 26, 2018 | Mar 26, 2018 |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Mar 26, 2018 |
| Centos_linux | — | centos-upgrade-httpdcentos-upgrade-httpd-debuginfocentos-upgrade-httpd-develcentos-upgrade-httpd-manualcentos-upgrade-httpd-toolscentos-upgrade-mod_ldapcentos-upgrade-mod_proxy_htmlcentos-upgrade-mod_sessioncentos-upgrade-mod_ssl | Oct 1, 2020 | Mar 26, 2018 |
| Debian | debian-upgrade-apache2 | Apr 4, 2018 | Mar 23, 2018 | |
| Freebsd | freebsd-upgrade-package-apache24freebsd-upgrade-package-apache22 | Mar 25, 2018 | Mar 24, 2018 | |
| Hpux | — | hpux-update-hpuxwsapache | Mar 28, 2022 | Mar 26, 2018 |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-httpdhuawei-euleros-2_0_sp1-upgrade-httpd-develhuawei-euleros-2_0_sp1-upgrade-httpd-manualhuawei-euleros-2_0_sp1-upgrade-httpd-toolshuawei-euleros-2_0_sp1-upgrade-mod_ssl | May 29, 2018 | Mar 26, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-httpdhuawei-euleros-2_0_sp2-upgrade-httpd-develhuawei-euleros-2_0_sp2-upgrade-httpd-manualhuawei-euleros-2_0_sp2-upgrade-httpd-toolshuawei-euleros-2_0_sp2-upgrade-mod_ssl | May 29, 2018 | Mar 26, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-httpdhuawei-euleros-2_0_sp3-upgrade-httpd-develhuawei-euleros-2_0_sp3-upgrade-httpd-manualhuawei-euleros-2_0_sp3-upgrade-httpd-toolshuawei-euleros-2_0_sp3-upgrade-mod_ssl | Jul 3, 2018 | Mar 26, 2018 | |
| Ibm Http_server | — | ibm-http_server-apply-interim-fix-pi95670-for-8_0ibm-http_server-apply-interim-fix-pi95670-for-8_5ibm-http_server-apply-interim-fix-pi95670-for-9_0 | Jun 22, 2018 | Mar 26, 2018 |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-server-apache-24-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-dbd-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ldap-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-lua-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-33-0-175-3-32-0-3-0 | May 16, 2018 | Mar 26, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-httpdoracle-linux-upgrade-httpd-develoracle-linux-upgrade-httpd-manualoracle-linux-upgrade-httpd-toolsoracle-linux-upgrade-mod-ldaporacle-linux-upgrade-mod-proxy-htmloracle-linux-upgrade-mod-sessionoracle-linux-upgrade-mod-ssl | Oct 13, 2020 | Mar 24, 2018 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-httpdredhat-upgrade-httpd-debuginforedhat-upgrade-httpd-develredhat-upgrade-httpd-manualredhat-upgrade-httpd-toolsredhat-upgrade-mod_ldapredhat-upgrade-mod_proxy_htmlredhat-upgrade-mod_sessionredhat-upgrade-mod_ssl | Oct 1, 2020 | Mar 26, 2018 | |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Apr 6, 2018 | Mar 23, 2018 |
| Ubuntu | ubuntu-upgrade-apache2-bin | Apr 25, 2018 | Mar 23, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Mar 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub