CVE-2024-38474

32

FAUCET Score

CVE-2024-38474 is a critical substitution encoding issue in Apache HTTP Server versions 2.4.59 and earlier, affecting Apache and NetApp products utilizing this server. This vulnerability allows an unauthenticated attacker to execute scripts in restricted directories or disclose sensitive script source code. With a CVSS score of 9.8 (Critical), it poses a high risk of complete compromise (confidentiality, integrity, availability) due to its network-based attack vector and low attack complexity. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, indicating awareness among researchers.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.4.0, < 2.4.60CPE matchmatch criteria	cpe:2.3:a:apache:http_server::::::::
		9.0CPE matchmatch criteria	cpe:2.3:o:netapp:clustered_data_ontap:9.0:::::::*
		>= 2.4.0, <= 2.4.59CPE match	cpe:2.3:a:apache:http_server::::::::

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

2.46%

Probability of exploitation in next 30 days

EPSS Percentile

82.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-28

Model: v2026.06.15

This CVE's current EPSS score of 0.0246 is in the 73rd percentile among its peer group of 36,897 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (29)

apachepatch availablevia llm_extracted

Fixed in: 2.4

githubpatch availablevia llm_extracted

redhatpatch availablevia redhat_api

Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_http2-0:1.15.19-41.el8jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_jk-0:1.2.49-11.redhat_1.el8jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_md-1:2.4.24-11.el8jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_proxy_cluster-0:1.3.20-8.el8jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-mod_security-0:2.9.3-40.el8jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.57-13.el7jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_http2-0:1.15.19-41.el7jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_jk-0:1.2.49-11.redhat_1.el7jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_md-1:2.4.24-11.el7jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_proxy_cluster-0:1.3.20-8.el7jbcs

redhatpatch availablevia redhat_api

Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_security-0:2.9.3-40.el7jbcs

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7.7 Advanced Update SupportFixed in: httpd-0:2.4.6-90.el7_7.4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: httpd-0:2.4.6-99.el7_9.2

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8Fixed in: httpd:2.4-8100020240712114234.489197e6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: httpd:2.4-8020020240720043142.4cda2c84

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: httpd:2.4-8040020240720035525.522a0ee4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: httpd:2.4-8040020240720035525.522a0ee4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: httpd:2.4-8040020240720035525.522a0ee4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportFixed in: httpd:2.4-8060020240719220036.ad008a3a

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceFixed in: httpd:2.4-8060020240719220036.ad008a3a

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsFixed in: httpd:2.4-8060020240719220036.ad008a3a

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: httpd:2.4-8080020240717184413.63b34585

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9Fixed in: httpd-0:2.4.57-11.el9_4

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsFixed in: httpd-0:2.4.51-7.el9_0.7

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: httpd-0:2.4.53-11.el9_2.8

redhatpatch availablevia redhat_api

Product: Text-Only JBCSFixed in: jbcs-httpd24-httpd

redhatpatch availablevia redhat_api

Product: JBoss Core Services for RHEL 8Fixed in: jbcs-httpd24-httpd-0:2.4.57-13.el8jbcs

Vendor Advisories (5)

apachellm-apache-f398f8ed28802aa3LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

apachellm-apache-a7a91ec4c0e9421dHIGH

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

githubllm-github-6953aa41d55714b2HIGH

AS-2024-007: Apache HTTP Server

redhatCVE-2024-38474Important

httpd: Substitution encoding issue in mod_rewrite

apachellm-apache-684e4d0003611bd4LOW

Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project

References

openwall.com / lists/oss-security/2024/07/01/7

httpd.apache.org / security/vulnerabilities_24.html

Vendor Advisory

security.netapp.com / advisory/ntap-20240712-0001

Third Party Advisory