Apache Server - Arbitrary File Read (CVE-2021-41773)
- Severity
- CVSSv3 Score
- 7.5
- Vulnerability description
Apache server is affected by an Arbitrary File Read through a Path Traversal vulnerability, located on the /cgi-bin endpoint. Any file outside the document root that is not protected with the "require all denied" configuration can be accessed by an unauthenticated remote attacker. The root cause of this vulnerability consists in a change done to the path normalization code in version 2.4.49 of Apache Server. Only this specific version is affected.
- Risk description
The risk exists that a remote unauthenticated attacker could exploit this vulnerability to read sensitive information from arbitrary files located on the file system of the server.
- Exploit capabilities
Sniper can read arbitrary files from the target system and extract them as evidence.
- Recommendation
Update the Apache server to a version equal or higher than 2.4.51.
- Codename
- Not available
- Detectable with
- Network Scanner
- Exploitable with Sniper
- Yes
- Vuln date
- Oct 2021
- Published at
- Updated at
- Software Type
- Web server
- Vendor
- Apache
- Product
- Server