daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update CVE-2021-41773.yaml

patch-1
Dhiyaneshwaran 2023-08-17 18:38:41 +05:30 committed by GitHub
parent 3ed60c2d8c
commit b04b1de4d0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
http/cves/2021/CVE-2021-41773.yaml
View File

@ -1,4 +1,4 @@
id: CVE-2021-41773 id: CVE-2021-41773
info: info:
name: Apache 2.4.49 - Path Traversal and Remote Code Execution name: Apache 2.4.49 - Path Traversal and Remote Code Execution
@ -8,15 +8,15 @@ info:
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by "require all denied" these requests can succeed. Additionally, this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.
reference: reference:
- https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782 - https://github.com/apache/httpd/commit/e150697086e70c552b2588f369f2d17815cb1782
- https://nvd.nist.gov/vuln/detail/CVE-2021-41773 - https://nvd.nist.gov/vuln/detail/CVE-2021-41773
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773
- https://twitter.com/ptswarm/status/1445376079548624899 - https://twitter.com/ptswarm/status/1445376079548624899
- https://twitter.com/h4x0r_dz/status/1445401960371429381 - https://twitter.com/h4x0r_dz/status/1445401960371429381
- https://github.com/blasty/CVE-2021-41773 - https://github.com/blasty/CVE-2021-41773
classification: classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5 cvss-score: 7.5
cve-id: CVE-2021-41773 cve-id: CVE-2021-41773
cwe-id: CWE-22 cwe-id: CWE-22
epss-score: 0.97532 epss-score: 0.97532
cpe: cpe:2.3:a:apache:http_server:2.4.49:*:*:*:*:*:*:* cpe: cpe:2.3:a:apache:http_server:2.4.49:*:*:*:*:*:*:*
@ -52,7 +52,7 @@ http:
- type: word - type: word
name: RCE name: RCE
words: words:
- "CVE-2021-41773 -POC" - "CVE-2021-41773-POC"
- type: regex - type: regex
name: LFI name: LFI