CVE-2021-42013
Scores
EPSS Score
0.9443
CVSS
3.x 9.8
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
All CVSS Scores
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
Было обнаружено, что исправление для CVE-2021-41773 в Apache HTTP Server 2.4.50 было недостаточным. Злоумышленник может использовать атаку обхода пути для сопоставления URL-адресов с файлами за пределами каталогов, настроенных директивами, подобными Alias. Если файлы за пределами этих каталогов не защищены обычной конфигурацией по умолчанию "require all denied", эти запросы могут быть успешными. Если CGI-скрипты также включены для этих псевдонимных путей, это может привести к удаленному выполнению кода. Эта проблема затрагивает только Apache 2.4.49 и Apache 2.4.50, а не более ранние версии.
Sources
CWEs
Related Vulnerabilities
Exploits
Reference Links
Vulnerable Software
Type: Configuration
Product: apache2
Operating System: ubuntu bionic 18.04
{
"unaffected": true
}Source: ubuntu
Type: Configuration
Product: apache2
Operating System: ubuntu focal 20.04
{
"unaffected": true
}Source: ubuntu
Type: Configuration
Product: apache2
Operating System: ubuntu hirsute 21.04
{
"unaffected": true
}Source: ubuntu
Type: Configuration
Product: apache2
Operating System: ubuntu impish 21.10
{
"unaffected": true
}Source: ubuntu
Type: Configuration
Product: apache2
Operating System: ubuntu jammy 22.04
{
"unaffected": true
}Source: ubuntu
Type: Configuration
Product: apache2
Operating System: ubuntu trusty 14.04
{
"unfixed": true
}Source: ubuntu
Type: Configuration
Product: apache2
Operating System: ubuntu xenial 16.04
{
"unfixed": true
}Source: ubuntu
Type: Configuration
Product: apache2
Operating System: debian
{
"fixed": "2.4.51-1"
}Source: debian
Type: Configuration
Product: apache2
Operating System: debian bullseye 11
{
"unaffected": true
}Source: debian
Type: Configuration
Product: apache2
Operating System: debian buster 10
{
"unaffected": true
}Source: debian
Type: Configuration
Product: apache2
Operating System: debian stretch 9
{
"unaffected": true
}Source: debian
Type: Configuration
Vendor: apache
Product: http_server
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:apache:http_server:2.4.49:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:apache:http_server:2.4.50:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: fedoraproject
Product: fedora
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: netapp
Product: cloud_backup
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: oracle
Product: instantis_enterprisetrack
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.2.6.0",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:secure_backup:*:*:*:*:*:*:*:*",
"versionEndExcluding": "18.1.0.1.0",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: oracle
Product: jd_edwards_enterpriseone_tools
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.2.6.0",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:secure_backup:*:*:*:*:*:*:*:*",
"versionEndExcluding": "18.1.0.1.0",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd
Type: Configuration
Vendor: oracle
Product: secure_backup
Operating System: * * *
{
"cpe_match": [
{
"cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.2.6.0",
"vulnerable": true
},
{
"cpe23uri": "cpe:2.3:a:oracle:secure_backup:*:*:*:*:*:*:*:*",
"versionEndExcluding": "18.1.0.1.0",
"vulnerable": true
}
],
"operator": "OR"
}Source: nvd