Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-httpdamazon-linux-ami-2-upgrade-httpd-debuginfoamazon-linux-ami-2-upgrade-httpd-develamazon-linux-ami-2-upgrade-httpd-filesystemamazon-linux-ami-2-upgrade-httpd-manualamazon-linux-ami-2-upgrade-httpd-toolsamazon-linux-ami-2-upgrade-mod_ldapamazon-linux-ami-2-upgrade-mod_mdamazon-linux-ami-2-upgrade-mod_proxy_htmlamazon-linux-ami-2-upgrade-mod_sessionamazon-linux-ami-2-upgrade-mod_ssl | Jun 24, 2021 | Jun 10, 2021 | |
| Amazon_linux | — | amazon-linux-upgrade-httpd24 | Jul 13, 2021 | Jun 10, 2021 |
| Apache Httpd | apache-httpd-upgrade-latest | Dec 22, 2021 | Jun 10, 2021 | |
| Check Point Gaia | check-point-gaia-upgrade | Feb 25, 2026 | Oct 27, 2021 | |
| Debian | debian-upgrade-apache2 | May 28, 2024 | Jun 10, 2021 | |
| Freebsd | freebsd-upgrade-package-apache24 | Nov 4, 2022 | Jun 10, 2021 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-apache | Jul 19, 2021 | Jun 10, 2021 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-web-server-apache-24-2-4-48-11-4-35-0-1-94-3oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-dbd-2-4-48-11-4-35-0-1-94-3oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-gss-2-4-48-11-4-35-0-1-94-3oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ldap-2-4-48-11-4-35-0-1-94-3oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-lua-2-4-48-11-4-35-0-1-94-3oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-2-4-48-11-4-35-0-1-94-3oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-48-11-4-35-0-1-94-3 | Oct 12, 2021 | Jun 10, 2021 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Jun 10, 2021 | |
| Ubuntu | no-fix-ubuntu-package | Jun 26, 2025 | Jun 10, 2021 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jun 10, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub