Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mod_sslUpgrade httpd-coreUpgrade httpd-toolsUpgrade mod_http2Upgrade mod_proxy_htmlUpgrade mod_mdUpgrade mod_ldapUpgrade httpd-manualUpgrade httpd-filesystemUpgrade mod_sessionUpgrade httpd-develUpgrade mod_luaUpgrade httpd | Jul 25, 2024 | Jul 1, 2024 |
| Alpine Linux | — | Upgrade apache2 | Aug 22, 2024 | Jul 1, 2024 |
| Amazon Linux Ami 2 | — | Upgrade httpd-manualUpgrade mod_sslUpgrade httpd-filesystemUpgrade mod_mdUpgrade mod_sessionUpgrade httpd-debuginfoUpgrade httpd-develUpgrade httpdUpgrade mod_ldapUpgrade mod_proxy_htmlUpgrade httpd-tools | Jul 23, 2024 | Jul 1, 2024 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-httpdamazon-linux-2023-upgrade-httpd-coreamazon-linux-2023-upgrade-httpd-core-debuginfoamazon-linux-2023-upgrade-httpd-debuginfoamazon-linux-2023-upgrade-httpd-debugsourceamazon-linux-2023-upgrade-httpd-develamazon-linux-2023-upgrade-httpd-filesystemamazon-linux-2023-upgrade-httpd-manualamazon-linux-2023-upgrade-httpd-toolsamazon-linux-2023-upgrade-httpd-tools-debuginfoamazon-linux-2023-upgrade-mod-ldapamazon-linux-2023-upgrade-mod-ldap-debuginfoamazon-linux-2023-upgrade-mod-luaamazon-linux-2023-upgrade-mod-lua-debuginfoamazon-linux-2023-upgrade-mod-proxy-htmlamazon-linux-2023-upgrade-mod-proxy-html-debuginfoamazon-linux-2023-upgrade-mod-sessionamazon-linux-2023-upgrade-mod-session-debuginfoamazon-linux-2023-upgrade-mod-sslamazon-linux-2023-upgrade-mod-ssl-debuginfo | Feb 17, 2025 | Jul 1, 2024 | |
| Apache Httpd | apache-httpd-upgrade-latest | Oct 14, 2024 | Jul 1, 2024 | |
| Check Point Gaia | — | Upgrade to supported version Check Point Gaia. | Feb 25, 2026 | Dec 4, 2024 |
| Debian | — | Upgrade apache2 | Jul 15, 2024 | Jul 1, 2024 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 13, 2024 |
| Freebsd | — | Upgrade apache24 | Jul 2, 2024 | Jul 1, 2024 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Sep 30, 2024 | Jul 1, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade httpd-toolsUpgrade httpd-filesystemUpgrade httpdUpgrade mod_ssl | Oct 8, 2024 | Jul 1, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade httpd-filesystemUpgrade httpdUpgrade httpd-toolsUpgrade mod_ssl | Oct 9, 2024 | Jul 1, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade httpdUpgrade httpd-filesystemUpgrade mod_sslUpgrade httpd-tools | Oct 8, 2024 | Jul 1, 2024 |
| Ibm Http_server | — | Apply IBM HTTP Server version 8.5.5.27 or laterApply IBM HTTP Server Interim Fix PH61893Apply IBM HTTP Server version 9.0.5.21 or later | Nov 20, 2025 | Jul 29, 2024 |
| Oracle_linux | — | oracle-linux-upgrade-httpdoracle-linux-upgrade-httpd-coreoracle-linux-upgrade-httpd-develoracle-linux-upgrade-httpd-filesystemoracle-linux-upgrade-httpd-manualoracle-linux-upgrade-httpd-toolsoracle-linux-upgrade-mod-http2oracle-linux-upgrade-mod-ldaporacle-linux-upgrade-mod-luaoracle-linux-upgrade-mod-mdoracle-linux-upgrade-mod-proxy-htmloracle-linux-upgrade-mod-sessionoracle-linux-upgrade-mod-ssl | Aug 16, 2024 | Jul 1, 2024 |
| Redhat_linux | redhat-upgrade-httpdredhat-upgrade-httpd-coreredhat-upgrade-httpd-core-debuginforedhat-upgrade-httpd-debuginforedhat-upgrade-httpd-debugsourceredhat-upgrade-httpd-develredhat-upgrade-httpd-filesystemredhat-upgrade-httpd-manualredhat-upgrade-httpd-toolsredhat-upgrade-httpd-tools-debuginforedhat-upgrade-mod_http2redhat-upgrade-mod_http2-debuginforedhat-upgrade-mod_http2-debugsourceredhat-upgrade-mod_ldapredhat-upgrade-mod_ldap-debuginforedhat-upgrade-mod_luaredhat-upgrade-mod_lua-debuginforedhat-upgrade-mod_mdredhat-upgrade-mod_md-debuginforedhat-upgrade-mod_md-debugsourceredhat-upgrade-mod_proxy_htmlredhat-upgrade-mod_proxy_html-debuginforedhat-upgrade-mod_sessionredhat-upgrade-mod_session-debuginforedhat-upgrade-mod_sslredhat-upgrade-mod_ssl-debuginfo | Jul 24, 2024 | Jul 1, 2024 | |
| Rocky_linux | rocky-upgrade-httpdrocky-upgrade-httpd-corerocky-upgrade-httpd-core-debuginforocky-upgrade-httpd-debuginforocky-upgrade-httpd-debugsourcerocky-upgrade-httpd-develrocky-upgrade-httpd-toolsrocky-upgrade-httpd-tools-debuginforocky-upgrade-mod_http2rocky-upgrade-mod_http2-debuginforocky-upgrade-mod_http2-debugsourcerocky-upgrade-mod_ldaprocky-upgrade-mod_ldap-debuginforocky-upgrade-mod_luarocky-upgrade-mod_lua-debuginforocky-upgrade-mod_mdrocky-upgrade-mod_md-debuginforocky-upgrade-mod_md-debugsourcerocky-upgrade-mod_proxy_htmlrocky-upgrade-mod_proxy_html-debuginforocky-upgrade-mod_sessionrocky-upgrade-mod_session-debuginforocky-upgrade-mod_sslrocky-upgrade-mod_ssl-debuginfo | Jul 29, 2024 | Jul 1, 2024 | |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-eventsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-manualsuse-upgrade-apache2-preforksuse-upgrade-apache2-tls13suse-upgrade-apache2-tls13-develsuse-upgrade-apache2-tls13-docsuse-upgrade-apache2-tls13-example-pagessuse-upgrade-apache2-tls13-preforksuse-upgrade-apache2-tls13-utilssuse-upgrade-apache2-tls13-workersuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Jul 12, 2024 | Jul 1, 2024 |
| Ubuntu | ubuntu-pro-upgrade-apache2ubuntu-upgrade-apache2 | Jul 9, 2024 | Jul 1, 2024 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jul 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub