Описание
Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | windows only |
| esm-infra-legacy/trusty | not-affected | windows only |
| esm-infra/bionic | not-affected | windows only |
| esm-infra/focal | not-affected | windows only |
| esm-infra/xenial | not-affected | windows only |
| jammy | not-affected | windows only |
| noble | not-affected | windows only |
| plucky | not-affected | windows only |
| questing | not-affected | windows only |
| upstream | not-affected | debian: Only affects Apache on Windows |
Показывать по
7.5 High
CVSS3
Связанные уязвимости
Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Serv ...
Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Уязвимость веб-сервера Apache HTTP Server, связанная с недостаточной проверкой запросов на стороне сервера, позволяющая нарушителю получить доступ к NTLM-хэшам
7.5 High
CVSS3