CVE-2021-40438
| Severity | 9.0 Critical CVSS 3.1 3 scores |
|---|---|
| Weakness | Server-side request forgery (CWE-918) |
| Published | 16 Sep 2021 |
| Updated | 6 Aug 2026 |
Description
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2021-12-01 · remediation due 2021-12-15 · ransomware use: known
- VulnCheck KEV listed Exploitation reported in the wild. 16 citations · honeypot sightings · 6 exploits · earliest 2021-12-01.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 11 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2021-10-18.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2021-40438 in VulnCheck (free account), which lists 11 more citations and 1 more exploit reference not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 583 days | 2023-12-06 to 2026-11-12 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2021-12-01 |
| Reported exploitation | unit42.paloaltonetworks.com | /network-attacks-trends-august-october-2021 | 2021-12-21 |
| Reported exploitation | trendmicro.com | /en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html | 2022-02-22 |
| Reported exploitation | info.securin.io | /hubfs/Securin%20Ransomware%20Report%202023.pdf | 2023-02-14 |
| Reported exploitation | paloaltonetworks.com | /content/dam/pan/en_US/assets/pdf/reports/unit42-cloud-threat-report-volume7.pdf | 2023-04-18 |
| Exploit reference | VulnCheck XDB 8bae635ca483 | Exploit type: info-leak | 2021-10-18 |
| Exploit reference | VulnCheck XDB 4961483e1a12 | Exploit type: infoleak | 2022-04-03 |
| Exploit reference | VulnCheck XDB e06f4c13b530 | Exploit type: infoleak | 2023-12-12 |
| Exploit reference | VulnCheck XDB fa2660f09705 | Exploit type: infoleak | 2024-10-23 |
| Exploit reference | VulnCheck XDB c2c694adbe9e | Exploit type: initial-access | 2025-01-22 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Apache forward request CVE | 20 | 2022-04-03 |
| Nuclei | Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery | ||
| GitHub PoC | CVE-2021-40438 exploit PoC with Docker setup. | 15 | 2021-10-24 |
| GitHub PoC | CVE-2021-40438 Apache <= 2.4.48 SSRF exploit | 11 | 2023-12-12 |
| GitHub PoC | xiaojiangxl/CVE-2021-40438 | 7 | 2021-10-18 |
| GitHub PoC | BabyTeam1024/CVE-2021-40438 | 2 | 2021-10-28 |
| GitHub PoC | Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery | 1 | 2024-05-19 |
| GitHub PoC | check CVE-2021-40438 | 1 | 2022-06-10 |
| GitHub PoC | Sigma-Rule-for-CVE-2021-40438-Attack-Attemp | 1 | 2021-11-30 |
| GitHub PoC | Check Point Security Gateways RCE via CVE-2021-40438 | 2025-01-22 |
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
9.0 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
3 metrics
CVSS
9.0 CRITICAL v3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.0 | CRITICAL | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.0 | CRITICAL | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 6.8 | none | AV:N/AC:M/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2022 ↗ | CPU | 2022-Q2 | Oracle Enterprise Manager / User Interface (Apache HTTP Server) (12.4.0.0) Oracle Virtualization / Web Server (Apache HTTP Server) (5.6) |
| Oracle Critical Patch Update January 2022 ↗ | CPU | 2022-Q1 | Oracle Fusion Middleware / OSSL Module (Apache HTTP Server) (12.2.1.3.0, 12.2.1.4.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Enterprise Manager | User Interface (Apache HTTP Server) | 12.4.0.0 | 12.4.0.0 |
| Oracle Fusion Middleware | OSSL Module (Apache HTTP Server) | 12.2.1.3.0, 12.2.1.4.0 | 12.2.1.3.0 · 12.2.1.4.0 |
| Oracle Virtualization | Web Server (Apache HTTP Server) | 5.6 | 5.6 |
Products and versions
39 products, 83 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | http server | generic | ≤ 2.4.48 |
| nvd | broadcom | brocade fabric operating system firmware | generic | any version |
| nvd | debian | debian linux | generic | 9.0 · 10.0 · 11.0 |
| nvd | f5 | f5os | generic | ≥ 1.1.0 and ≤ 1.1.4 · ≥ 1.2.0 and ≤ 1.2.1 |
| nvd | fedoraproject | fedora | generic | 34 · 35 |
| nvd | netapp | cloud backup | generic | any version |
| nvd | netapp | clustered data ontap | generic | any version |
| nvd | netapp | storagegrid | generic | any version |
| nvd | oracle | enterprise manager ops center | generic | 12.4.0.0 |
| nvd | oracle | http server | generic | 12.2.1.3.0 · 12.2.1.4.0 |
| nvd | oracle | instantis enterprisetrack | generic | 17.1 · 17.2 · 17.3 |
| nvd | oracle | secure global desktop | generic | 5.6 |
| nvd | oracle | zfs storage appliance kit | generic | 8.8 |
| nvd | redhat | enterprise linux | generic | 8.0 |
| nvd | redhat | enterprise linux eus | generic | 8.1 · 8.2 · 8.4 · 8.6 · 8.8 |
| nvd | redhat | enterprise linux for arm 64 | generic | 8.0 |
| nvd | redhat | enterprise linux for arm 64 eus | generic | 8.6 · 8.8 |
| nvd | redhat | enterprise linux for ibm z systems | generic | 7.0_s390x · 8.0 |
| nvd | redhat | enterprise linux for ibm z systems eus | generic | 8.1 · 8.4 · 8.8 |
| nvd | redhat | enterprise linux for ibm z systems eus s390x | generic | 8.2 |
| nvd | redhat | enterprise linux for power big endian | generic | 7.0 |
| nvd | redhat | enterprise linux for power little endian | generic | 7.0 · 8.0 |
| nvd | redhat | enterprise linux for power little endian eus | generic | 8.1 · 8.2 · 8.4 · 8.6 · 8.8 |
| nvd | redhat | enterprise linux for scientific computing | generic | 7.0 |
| nvd | redhat | enterprise linux server | generic | 7.0 |
| nvd | redhat | enterprise linux server aus | generic | 7.2 · 7.3 · 7.4 · 7.6 · 7.7 · 8.2 · 8.4 · 8.6 |
| nvd | redhat | enterprise linux server for power little endian update services for sap solutions | generic | 7.6 · 7.7 · 8.1 · 8.2 · 8.4 · 8.6 · 8.8 |
| nvd | redhat | enterprise linux server tus | generic | 7.6 · 7.7 · 8.2 · 8.4 · 8.6 · 8.8 |
| nvd | redhat | enterprise linux server update services for sap solutions | generic | 7.6 · 7.7 |
| nvd | redhat | enterprise linux update services for sap solutions | generic | 8.1 · 8.2 · 8.4 · 8.6 · 8.8 |
| nvd | redhat | enterprise linux workstation | generic | 7.0 |
| nvd | redhat | jboss core services | generic | 1.0 |
| nvd | redhat | software collections | generic | 1.0 |
| nvd | resf | rocky linux | generic | 8.0 |
| nvd | siemens | ruggedcom nms | generic | any version |
| nvd | siemens | sinec nms | generic | ＜ 1.0.3 |
| nvd | siemens | sinema remote connect server | generic | ＜ 3.1 · 3.2 |
| nvd | siemens | sinema server | generic | 14.0 |
| nvd | tenable | tenable.sc | generic | ≤ 5.19.1 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, NO AUTH REMOTE EXPLOIT, OSSL MODULE (APACHE HTTP SERVER) **Products:** ORACLE HTTP SERVER, ORACLE FUSION MIDDLEWARE
References
Timeline
Timeline
| Published | 2021-09-16 | By the CVE Program. |
|---|---|---|
| Added to CISA KEV | 2021-12-01 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: earliest evidence | 2021-12-01 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| NVD record modified | 2026-08-06 | NVD's own last-modified date for this record. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |