Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-39884

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.

Published

2024-07-04T09:15:04.237

Last Modified

2025-07-01T20:27:13.287

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.2 (MEDIUM)

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	apache	http_server	2.4.60	Yes
Application	netapp	ontap_tools	10	Yes

References

http://www.openwall.com/lists/oss-security/2024/07/17/6 Mailing List ([email protected])
https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory ([email protected])
https://security.netapp.com/advisory/ntap-20240712-0002/ Third Party Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2024/07/03/8 Mailing List (af854a3a-2127-422b-91ae-364da2661108)
http://www.openwall.com/lists/oss-security/2024/07/17/6 Mailing List (af854a3a-2127-422b-91ae-364da2661108)
https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20240712-0002/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)