Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-38472

73
FAUCET Score

CVE-2024-38472 is a Server-Side Request Forgery (SSRF) vulnerability in Apache HTTP Server on Windows, allowing for the potential leakage of NTLM hashes to a malicious server. This high-severity vulnerability (CVSS 7.5) has a low attack complexity and can lead to significant information disclosure. While not currently in the KEV catalog, Nuclei templates exist for detecting this flaw, and it has garnered notable community discussion and media coverage, indicating active awareness. Users are advised to upgrade to version 2.4.60, configuring the new "UNCList" directive if UNC paths are in use.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.4.0, < 2.4.60CPE matchmatch criteria
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
9CPE matchmatch criteria
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
>= 2.4.0, <= 2.4.59CPE match
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
67.95%
Probability of exploitation in next 30 days
EPSS Percentile
99.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
Nuclei: CVE-2024-38472 · Jan 1, 1970
This CVE's current EPSS score of 0.6795 is in the 99th percentile among its peer group of 51,506 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (7)

apachepatch availablevia llm_extracted
Fixed in: 2.4
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 2.4.61-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 2.4.61-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 2.4.61-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 2.4.61-1
redhatpatch availablevia redhat_api
Product: Text-Only JBCS
View patch
redhatno patchvia redhat_api
Product: Red Hat JBoss Core ServicesFixed in: jbcs-httpd24-httpd

Vendor Advisories (5)

apachellm-apache-f398f8ed28802aa3LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

Mar 2, 2026
apachellm-apache-a7a91ec4c0e9421dHIGH

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

Dec 10, 2025
microsoft2024-Dec/CVE-2024-38472

CVE-2024-38472

Dec 10, 2024
redhatCVE-2024-38472Important

httpd: SSRF in Apache HTTP Server on Windows

Jul 1, 2024
apachellm-apache-684e4d0003611bd4LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

References

security.netapp.com / advisory/ntap-20240712-0001
Third Party Advisory
openwall.com / lists/oss-security/2024/07/01/5
Mailing List
httpd.apache.org / security/vulnerabilities_24.html
Vendor Advisory