Dashboard / CVE-2024-38472

CVE-2024-38472

HIGH 2 PoCs
ACT NOW Priority: 5.21 BB Relevance: 95/100
Published: 2024-07-01 Modified: 2026-11-04 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: None
A: None

Description

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
Apache Software Foundation Apache HTTP Server 2.4.0
Apache Software Foundation Apache HTTP Server 2.4.0
apache http_server 2.4.0 – 2.4.60
netapp ontap 9

References & Advisories (3)

Proof of Concept (2)

★ 135
https://github.com/mrmtwoj/apache-vulnerability-testing
nomi-sec
★ 4
https://github.com/Abdurahmon3236/CVE-2024-38472
nomi-sec

Bug Bounty Relevance

95 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ PoC available (2)
✓ High exploitation probability

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

69.47%
Raw Score 0.694700
Percentile 99.4%
Date 2026-11-04

EPSS Trend

2026-11-04
0.69470
2026-11-03
0.69470

Intelligence Sources

mitre ref →
nvd ref →

External Links