CVE-2024-38475

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

• CWE-116

• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://security.netapp.com/advisory/ntap-20240712-0001/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2024/07/01/8Third Party Advisory
• https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cfPatch
• https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240712-0001/Third Party Advisory
• https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475Third Party Advisory, US Government Resource

Published

Jul 1, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-3847Insufficient policy enforcement in WebUI in Google Chrome pr…6.1
• CVE-2024-38470zhimengzhe iBarn v1.5 was discovered to contain a reflected …6.1
• CVE-2024-38471Multiple TP-LINK products allow a network-adjacent attacker …6.8
• CVE-2024-38472SSRF in Apache HTTP Server on Windows allows to potentially …7.5
• CVE-2024-38473Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 a…8.1
• CVE-2024-38474Substitution encoding issue in mod_rewrite in Apache HTTP Se…9.8
• CVE-2024-38476Vulnerability in core of Apache HTTP Server 2.4.59 and earli…9.8
• CVE-2024-38477null pointer dereference in mod_proxy in Apache HTTP Server …7.5
• CVE-2024-38479Improper Input Validation vulnerability in Apache Traffic Se…7.5
• CVE-2024-3848A path traversal vulnerability exists in mlflow/mlflow versi…7.5
• CVE-2024-38480"Piccoma" App for Android and iOS versions prior to 6.20.0 u…4
• CVE-2024-38481Dell iDRAC Service Module version 5.3.0.0 and prior, contain…4.4