Threats tagged 'ghsa-pf44-j75v-mhr8'

CVE-2024-38475 is a critical vulnerability in Apache HTTP Server 2.4.59 and earlier involving improper escaping of output in mod_rewrite. This flaw allows attackers to map URLs to filesystem locations that are accessible by the server but not intended to be reachable via URLs, potentially leading to code execution or source code disclosure. The issue affects substitutions in server context that use backreferences or variables as the first segment of the substitution. The rewrite flag "UnsafePrefixStat" can be used to opt back in after ensuring substitutions are properly constrained.