Users Advised To Patch Fixed Apache Zero-day Vulnerability

Share post:

The Apache Software Foundation has fixed two vulnerabilities, one of which has been actively exploited path traversal and file disclosure flaw in a recently released version 2.4.50 of the HTTP Web Server (an open source, cross-platform web server) and the second vulnerability, a zero pointer deference tracked as CVE-2021-41524.

The zero-day vulnerability in question, traced as CVE-2021-41773, allows attackers to map URL files outside the expected document root by launching a path traversal attack. The attack involves sending requests to access backend or sensitive server directories that are normally out of reach, causing interpreted files such as CGI scripts leak.

The second vulnerability, discovered while processing HTTP/2 requests three weeks ago, allows attackers to perform a DDoS attack on a server. Though it is not being actively exploited, it has also been infected in the current version 2.4.50, after it was discovered in late September.

For more information, read the original story in Bleeping Computer.


Related articles

Security research team claims to have helped avert a major supply chain attack

JFrog Security Research team continuously scans public repositories such as Docker Hub, NPM, and PyPI to identify malicious...

Phishing attacks on state and local governments surge by 360%

Phishing attacks targeting state and local governments have surged by 360% between May 2023 and May 2024, according...

What is Ticketmaster saying to its customers?

Here's the letter that has been sent out out to Ticketmaster clients that a reader sent to me....

Cyber Security Today, July 8, 2024 – New ransomware group discovered, and summer podcast break starts

A new ransomware group is discovered. Welcome to Cyber Security Today. It's Monday July 8th, 2024. I'm Howard Solomon,...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways