CVE-2025-59775

Опубликовано: 05 дек. 2025

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Server-Side Request Forgery (SSRF) vulnerability

in Apache HTTP Server on Windows

with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

Ссылки

https://httpd.apache.org/security/vulnerabilities_24.html
Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/12/04/6
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Версия от 2.4.0 (включая) до 2.4.66 (исключая)

EPSS

Процентиль: 18%

0.00056

Низкий

7.5 High

CVSS3

Дефекты

CWE-918

Связанные уязвимости

CVE-2025-59775

CVSS3: 7.5

ubuntu

4 месяца назад

Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVE-2025-59775

CVSS3: 7.5

redhat

4 месяца назад

CVE-2025-59775

msrc

4 месяца назад

Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF

CVE-2025-59775

CVSS3: 7.5

debian

4 месяца назад

Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Serv ...

GHSA-7w72-74p3-5cfq

CVSS3: 7.5

github

4 месяца назад

EPSS

Процентиль: 18%

0.00056

Низкий

7.5 High

CVSS3

Дефекты

CWE-918