WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Fusion Middleware / Mod_rewrite, Core (Apache HTTP Server)✕
Overview 4 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
4matches 0in Waratek scope0.0% 0protected0.0% 1exploited25.0% 1CISA KEV25.0% 3public PoC75.0% 1EPSS ≥ 0.525.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 25.0% Not applicable 3 75.0% Withdrawn CVE 0 0.0%
Critical 2 50.0% High 2 50.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 25.0% Working exploit published 1 25.0% Proof of concept only 1 25.0% Forecast only 0 0.0% No public exploit 1 25.0%
split by peak 3 / month
Not applicable: 3Outside Waratek scope: 1 High: 2Critical: 2 not blocked: 4 No public exploit: 1Proof of concept only: 1Working exploit published: 1Exploited: 1
Apr 241 Outside Waratek scope1 High1 not blocked1 Proof of concept only1 May 240 Jun 240 Jul 243 Not applicable3 Critical2 High1 not blocked3 Exploited1 Working exploit published1 No public exploit1
Apr 24May 24Jun 24Jul 24
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-40898 Critical 2024-07-18 Not applicable No public exploit SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. 
CVE-2024-38475 Critical 2024-07-01 Not applicable Exploited Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
CVE-2024-38473 High 2024-07-01 Not applicable Working exploit published Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
CVE-2023-38709 High 2024-04-04 Outside Waratek scope Proof of concept only Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.