Apache HTTP Server-Side Request Forgery (SSRF). Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 01/12/2021. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.
| Package | Affected versions | Patched versions |
|---|---|---|
| http server | ≤ 2.4.48 | |
| enterprise manager ops center | = 12.4.0.0 | |
| http server | = 12.2.1.3.0= 12.2.1.4.0 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| secure global desktop | = 5.6 | |
| zfs storage appliance kit | = 8.8 | |
| jboss core services | = 1.0 | |
| software collections | = 1.0 | |
| sinec nms | < 1.0.3 | 1.0.3 |
| sinema remote connect server | = 3.2< 3.1 | 3.1 |
| sinema server | = 14.0 | |
| tenable.sc | ≤ 5.19.1 |
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free