CRITICAL🚩 CISA KEV⚡ EXPLOIT✓ PATCH🇵🇱 Wersja polska

CVE-2021-40438

CVSS 9.0v3.1pub. 2021-09-16upd. 2026-08-06

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Apache HTTP Server
APP
Apache
≤ 2.4.48
Broadcom Brocade Fabric Operating System Firmware
OS
Broadcom
all versions
Debian
OS
Debian
10.011.09.0
F5 F5os
OS
F5
1.2.0 – 1.2.11.1.0 – 1.1.4
Fedora Project Fedora
OS
Fedoraproject
3435
Netapp Cloud Backup
APP
Netapp
all versions
Netapp Clustered Data Ontap
APP
Netapp
all versions
Netapp Storagegrid
APP
Netapp
all versions
Oracle Enterprise Manager Ops Center
APP
Oracle
12.4.0.0
Oracle HTTP Server
APP
Oracle
12.2.1.3.012.2.1.4.0
Oracle Instantis Enterprisetrack
APP
Oracle
17.117.217.3
Oracle Secure Global Desktop
APP
Oracle
5.6
Oracle Zfs Storage Appliance Kit
APP
Oracle
8.8
Red Hat Enterprise Linux
OS
Redhat
7.08.0
Red Hat Enterprise Linux Eus
OS
Redhat
8.18.28.48.68.8
Red Hat Enterprise Linux For Arm 64
OS
Redhat
8.0
Red Hat Enterprise Linux For Arm 64 Eus
OS
Redhat
8.68.8
Red Hat Enterprise Linux For IBM Z Systems
OS
Redhat
7.0_s390x8.0
Red Hat Enterprise Linux For IBM Z Systems Eus
OS
Redhat
8.18.48.8
Red Hat Enterprise Linux For IBM Z Systems Eus S390x
OS
Redhat
8.2
Red Hat Enterprise Linux For Power Big Endian
OS
Redhat
7.0
Red Hat Enterprise Linux For Power Little Endian
OS
Redhat
7.08.0
Red Hat Enterprise Linux For Power Little Endian Eus
OS
Redhat
8.18.28.48.68.8
Red Hat Enterprise Linux For Scientific Computing
OS
Redhat
7.0
Red Hat Enterprise Linux Server
OS
Redhat
7.0
Red Hat Enterprise Linux Server Aus
OS
Redhat
7.27.37.47.67.78.28.48.6
Red Hat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions
OS
Redhat
7.67.78.18.28.48.68.8
Red Hat Enterprise Linux Server Tus
OS
Redhat
7.67.78.28.48.68.8
Red Hat Enterprise Linux Server Update Services For Sap Solutions
OS
Redhat
7.67.7
Red Hat Enterprise Linux Server Workstation
OS
Redhat
7.0

CISA KEV — detailsi

Vendori: Apache ↗
Producti: Apache
Added to KEVi: December 1, 2021
Remediation deadline (US Federal)i: December 15, 2021(overdue)
Ransomwarei: Active ransomware campaigns exploit this vulnerability

🔧Advisory Apache↗🇺🇸CISA KEV (original)↗

Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

🔴