CVE-2021-40438

Public on 2021-09-16
Modified on 2021-10-15
Description
A Server-Side Request Forgery (SSRF) flaw was found in mod_proxy of httpd. This flaw allows a remote, unauthenticated attacker to make the httpd server forward requests to an arbitrary server. The attacker could get, modify, or delete resources on other services that may be behind a firewall and inaccessible otherwise. The impact of this flaw varies based on what services and resources are available on the httpd network.
Severity
Important severity
Important
CVSS v3 Base Score
9.0
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core httpd 2021-10-15 ALAS2-2021-1716 Fixed
Amazon Linux 1 httpd24 2021-10-15 ALAS-2021-1543 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD CVSSv2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
NVD CVSSv3 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H