Description

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Remediation

References

CVE-2024-38473

Related Vulnerabilities

Django Improper Input Validation Vulnerability (CVE-2023-31047)

PHP Out-of-bounds Read Vulnerability (CVE-2018-20783)

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-43804)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-0218)

SharePoint CVE-2022-44693 Vulnerability (CVE-2022-44693)

Severity

High

Classification

CVE-2024-38473 CWE-116 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Tags

Missing Update Known Vulnerabilities