{"id":"CVE-2021-41773","aliases":["ALPINE-CVE-2021-41773","BELL-CVE-2021-41773","BIT-apache-2021-41773","DEBIAN-CVE-2021-41773","EUVD-2021-28781","GHSA-29h7-gr57-5f8r","MGASA-2021-0461","openSUSE-SU-2024:11560-1"],"status":"published","title":"Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99992,"percentile":0.99986,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2021-10-05T08:40:12Z","modified":"2026-10-24T10:30:39Z","kev":{"date_added":"2021-11-03","due_date":"2021-11-17","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/apache_normalize_path_rce","title":"Apache 2.4.49/2.4.50 Traversal RCE","type":"exploit","platform":"Linux,Unix","date":"2021-05-10","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/apache_normalize_path_rce"},{"source":"pocgithub","id":"TishcaTpx/POC-CVE-2021-41773","title":"TishcaTpx/POC-CVE-2021-41773","date":"2021-10-05","url":"https://github.com/TishcaTpx/POC-CVE-2021-41773"},{"source":"pocgithub","id":"Vulnmachines/cve-2021-41773","title":"Vulnmachines/cve-2021-41773","date":"2021-10-05","url":"https://github.com/Vulnmachines/cve-2021-41773"},{"source":"pocgithub","id":"ZephrFish/CVE-2021-41773-PoC","title":"ZephrFish/CVE-2021-41773-PoC","date":"2021-10-05","url":"https://github.com/ZephrFish/CVE-2021-41773-PoC"},{"source":"pocgithub","id":"iilegacyyii/PoC-CVE-2021-41773","title":"iilegacyyii/PoC-CVE-2021-41773","date":"2021-10-05","url":"https://github.com/iilegacyyii/PoC-CVE-2021-41773"},{"source":"pocgithub","id":"j4k0m/CVE-2021-41773","title":"j4k0m/CVE-2021-41773","date":"2021-10-05","url":"https://github.com/j4k0m/CVE-2021-41773"},{"source":"pocgithub","id":"knqyf263/CVE-2021-41773","title":"knqyf263/CVE-2021-41773","date":"2021-10-05","url":"https://github.com/knqyf263/CVE-2021-41773"},{"source":"pocgithub","id":"lorddemon/CVE-2021-41773-PoC","title":"lorddemon/CVE-2021-41773-PoC","date":"2021-10-05","url":"https://github.com/lorddemon/CVE-2021-41773-PoC"},{"source":"pocgithub","id":"masahiro331/CVE-2021-41773","title":"masahiro331/CVE-2021-41773","date":"2021-10-05","url":"https://github.com/masahiro331/CVE-2021-41773"},{"source":"pocgithub","id":"numanturle/CVE-2021-41773","title":"numanturle/CVE-2021-41773","date":"2021-10-05","url":"https://github.com/numanturle/CVE-2021-41773"},{"source":"pocgithub","id":"1nhann/CVE-2021-41773","title":"1nhann/CVE-2021-41773","date":"2021-10-06","url":"https://github.com/1nhann/CVE-2021-41773"},{"source":"pocgithub","id":"AssassinUKG/CVE-2021-41773","title":"AssassinUKG/CVE-2021-41773","date":"2021-10-06","url":"https://github.com/AssassinUKG/CVE-2021-41773"},{"source":"pocgithub","id":"BlueTeamSteve/CVE-2021-41773","title":"BlueTeamSteve/CVE-2021-41773","date":"2021-10-06","url":"https://github.com/BlueTeamSteve/CVE-2021-41773"},{"source":"exploitdb","id":"EDB-50383","title":"Apache HTTP Server 2.4.49 - Path Traversal \u0026 Remote Code Execution (RCE)","type":"webapps","platform":"multiple","date":"2021-10-06","verified":true,"url":"https://www.exploit-db.com/exploits/50383"},{"source":"pocgithub","id":"Ls4ss/CVE-2021-41773_CVE-2021-42013","title":"Ls4ss/CVE-2021-41773_CVE-2021-42013","date":"2021-10-06","url":"https://github.com/Ls4ss/CVE-2021-41773_CVE-2021-42013"},{"source":"pocgithub","id":"TAI-REx/cve-2021-41773-nse","title":"TAI-REx/cve-2021-41773-nse","date":"2021-10-06","url":"https://github.com/TAI-REx/cve-2021-41773-nse"},{"source":"pocgithub","id":"Zeop-CyberSec/apache_normalize_path","title":"Zeop-CyberSec/apache_normalize_path","date":"2021-10-06","url":"https://github.com/Zeop-CyberSec/apache_normalize_path"},{"source":"pocgithub","id":"blasty/CVE-2021-41773","title":"blasty/CVE-2021-41773","date":"2021-10-06","url":"https://github.com/blasty/CVE-2021-41773"},{"source":"pocgithub","id":"creadpag/CVE-2021-41773-POC","title":"creadpag/CVE-2021-41773-POC","date":"2021-10-06","url":"https://github.com/creadpag/CVE-2021-41773-POC"},{"source":"pocgithub","id":"dishantsehgal/CVE-2021-41773","title":"dishantsehgal/CVE-2021-41773","date":"2021-10-06","url":"https://github.com/dishantsehgal/CVE-2021-41773"},{"source":"pocgithub","id":"fnatalucci/CVE-2021-41773-RCE","title":"fnatalucci/CVE-2021-41773-RCE","date":"2021-10-06","url":"https://github.com/fnatalucci/CVE-2021-41773-RCE"},{"source":"pocgithub","id":"habibiefaried/CVE-2021-41773-PoC","title":"habibiefaried/CVE-2021-41773-PoC","date":"2021-10-06","url":"https://github.com/habibiefaried/CVE-2021-41773-PoC"},{"source":"pocgithub","id":"itsecurityco/CVE-2021-41773","title":"itsecurityco/CVE-2021-41773","date":"2021-10-06","url":"https://github.com/itsecurityco/CVE-2021-41773"},{"source":"pocgithub","id":"jbovet/CVE-2021-41773","title":"jbovet/CVE-2021-41773","date":"2021-10-06","url":"https://github.com/jbovet/CVE-2021-41773"},{"source":"pocgithub","id":"jheeree/Simple-CVE-2021-41773-checker","title":"jheeree/Simple-CVE-2021-41773-checker","date":"2021-10-06","url":"https://github.com/jheeree/Simple-CVE-2021-41773-checker"},{"source":"pocgithub","id":"mohwahyudi/cve-2021-41773","title":"mohwahyudi/cve-2021-41773","date":"2021-10-06","url":"https://github.com/mohwahyudi/cve-2021-41773"},{"source":"pocgithub","id":"n3k00n3/CVE-2021-41773","title":"n3k00n3/CVE-2021-41773","date":"2021-10-06","url":"https://github.com/n3k00n3/CVE-2021-41773"},{"source":"exploitdb","id":"EDB-50512","title":"Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)","type":"webapps","platform":"multiple","date":"2021-11-11","verified":true,"url":"https://www.exploit-db.com/exploits/50512"},{"source":"metasploit","id":"auxiliary/scanner/http/apache_normalize_path","title":"Apache 2.4.49/2.4.50 Traversal RCE scanner","type":"auxiliary","date":"2021-05-10","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/apache_normalize_path"},{"source":"nuclei","id":"CVE-2021-41773","title":"Apache 2.4.49 - Path Traversal and Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41773.yaml"}],"exploits_more":150,"fixes":[{"ecosystem":"Alpine:v3.11","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.50-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apache","fixed_in":["2.4.50"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.50-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.50-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.50-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apache","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.49"},{"fixed":"2.4.50"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.50-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.51-1.1"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"http server"},{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"oracle","product":"instantis_enterprisetrack"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f%40%3Cusers.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","discussion","article"]},{"url":"https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","discussion","article"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/05/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/07/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","discussion","article"]},{"url":"https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","discussion","article"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/07/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ","tags":["vendor-advisory","x_refsource_CISCO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","advisory","evidence"]},{"url":"https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","advisory","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/08/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/09/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/164418/Apache-HTTP-Server-2.4.49-Path-Traversal-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/11/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Release Notes","article","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Release Notes","article","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/15/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/16/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20211029-0009/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","evidence"]},{"url":"https://security.gentoo.org/glsa/202208-20","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41773","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41773","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r6abf5f2ba6f1aa8b1030f95367aaf17660c4e4c78cb2338aee18982f@%3Cusers.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837@%3Cannounce.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r98d704ed4377ed889d40479db79ed1ee2f43b2ebdd79ce84b042df45@%3Cannounce.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb@%3Cusers.httpd.apache.org%3E"},{"url":"https://security.netapp.com/advisory/ntap-20211029-0009"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC"},{"url":"https://github.com/advisories/GHSA-29h7-gr57-5f8r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-41773","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-41773","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-41773","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0461.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29530","tags":["report"]},{"url":"https://downloads.apache.org/httpd/Announcement2.4.html","tags":["web"]},{"url":"https://downloads.apache.org/httpd/CHANGES_2.4.50","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42013","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-41773","title":"Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","status":"published","published":"2021-10-05T08:40:12Z","modified":"2025-10-21T23:25:30.864Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-28781","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","status":"published","published":"2021-10-05T08:40:12Z","modified":"2025-10-21T23:25:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:25.901288Z"}],"ghsa":[{"id":"GHSA-29h7-gr57-5f8r","title":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker...","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document root. If files outside of the document root are not protected by \"require all denied\" these requests can succeed. Additionally this flaw could leak the source of interpreted files like CGI scripts. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions.","status":"published","published":"2022-05-24T19:16:37Z","modified":"2025-10-22T00:32:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:05.344883Z"}],"kev":[{"id":"CVE-2021-41773","title":"Apache HTTP Server Path Traversal Vulnerability","description":"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.","cwes":["CWE-22"],"kev":{"date_added":"2021-11-03","due_date":"2021-11-17","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2021-41773","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","status":"published","published":"2021-10-05T09:15:07.593Z","modified":"2026-06-17T04:08:53.933Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:59.314106Z"}],"osv":[{"id":"ALPINE-CVE-2021-41773","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","status":"published","published":"2021-10-05T09:15:07.593Z","modified":"2026-10-23T17:17:56.215544733Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-41773","title":"CVE-2021-41773 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:48.838668Z","modified":"2026-02-19T07:15:21.46117Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-41773","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","status":"published","published":"2021-10-05T09:15:07.593Z","modified":"2026-10-24T10:30:39.568478262Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.557945Z"},{"id":"DEBIAN-CVE-2021-41773","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","status":"published","published":"2021-10-05T09:15:07.593Z","modified":"2026-10-23T18:04:15.665998222Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:35.799676Z"},{"id":"BIT-apache-2021-41773","title":"Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49","description":"A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration \"require all denied\", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.","status":"published","published":"2024-03-06T10:54:39.31Z","modified":"2026-09-08T08:45:41.541933421Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"MGASA-2021-0461","title":"Updated apache packages fix security vulnerabilities","description":"The updated packages fix a security vulnerabilities:\n\nWhile fuzzing the 2.4.49 httpd, a new null pointer dereference was\ndetected during HTTP/2 request processing, allowing an external source\nto DoS the server. This requires a specially crafted request. The\nvulnerability was recently introduced in version 2.4.49. No exploit is\nknown to the project (CVE-2021-41524).\n\nA flaw was found in a change made to path normalization in Apache HTTP\nServer 2.4.49. An attacker could use a path traversal attack to map URLs\nto files outside the expected document root. If files outside of the\ndocument root are not protected by \"require all denied\" these requests can\nsucceed. Additionally this flaw could leak the source of interpreted files\nlike CGI scripts. This issue is known to be exploited in the wild. This\nissue only affects Apache 2.4.49 and not earlier versions (CVE-2021-41773).\n","status":"published","published":"2021-10-06T14:38:41Z","modified":"2026-04-16T04:42:50.017322603Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11560-1","title":"apache2-2.4.51-1.1 on GA media","description":"These are all security issues fixed in the apache2-2.4.51-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:00.752092Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}