CVE-2024-38472

Apache HTTP Server on WIndows UNC SSRF

7.5 HighPublic exploitFix available

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

69.5%Up 69.4 points since Jul 2, 2024

What each source reports

CVE List Score used 7.5

Apache HTTP Server on WIndows UNC SSRF

Record: CVE-2024-38472
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-04

EUVDEUVD-2024-37353 7.5

Record: EUVD-2024-37353
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-04

GitHub AdvisoriesGHSA-fjcc-r94c-wxr8 7.5

SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious...

SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

Record: GHSA-fjcc-r94c-wxr8
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 7.5

Record: CVE-2024-38472
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-04

OSVALPINE-CVE-2024-38472 7.5

Record: ALPINE-CVE-2024-38472
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVBELL-CVE-2024-38472 7.5

CVE-2024-38472 does not affect BellSoft software

Record: BELL-CVE-2024-38472
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSV 7.5

Apache HTTP Server on WIndows UNC SSRF

Record: CVE-2024-38472
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-07

OSVBIT-apache-2024-38472 No score

Record: BIT-apache-2024-38472
Updated: 2026-11-02

OSVopenSUSE-SU-2024:14116-1 No score

apache2-2.4.61-1.1 on GA media

These are all security issues fixed in the apache2-2.4.61-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:14116-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`apache2` Alpine:v3.17	before 2.4.60-r0	2.4.60-r0
`apache2` Alpine:v3.18	before 2.4.60-r0	2.4.60-r0
`apache2` Alpine:v3.19	before 2.4.60-r0	2.4.60-r0
`apache2` Alpine:v3.20	before 2.4.60-r0	2.4.60-r0
`apache2` Alpine:v3.21	before 2.4.60-r0	2.4.60-r0
`apache2` Alpine:v3.22	before 2.4.60-r0	2.4.60-r0
`apache2` Alpine:v3.23	before 2.4.60-r0	2.4.60-r0
`apache2` Alpine:v3.24	before 2.4.60-r0	2.4.60-r0
`apache` Bitnami	2.4.0 up to 2.4.60	2.4.60
`apache2` openSUSE:Tumbleweed From an advisory covering 9 CVEs	before 2.4.61-1.1	2.4.61-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	Abdurahmon3236/CVE-2024-38472	2024-08-03
PoC in GitHub	mrmtwoj/apache-vulnerability-testing	2024-10-05
Nuclei	Apache HTTPd Windows UNC - Server-Side Request Forgery

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	CVE List, EUVD, NVD, OSV
Nov 3, 2026	exploits, facts	CVE List, EUVD
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38472 is a high vulnerability (CVSS 7.5) in Apache Http Server, published July 1, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 69.5%, the 99th percentile. Fixed in apache2 2.4.60-r0.

References

Show 11 moreShow less