{"id":"CVE-2024-38472","title":"SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content \nUsers are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing con…","summary":"SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content \nUsers are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing con…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-918"],"vendor":"apache","product":"http_server","affected":["http_server >= 2.4.0, < 2.4.60","ontap = 9"],"patched":["http_server 2.4.60"],"published":"2024-07-01","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:17:21.750","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-38472","references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","label":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2024/07/01/5","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20240712-0001/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2024-07-26T03:55:31.579855Z"},"epss":0.6947,"epssPercentile":0.99364,"exploits":{"github":2,"githubRepos":["https://github.com/Abdurahmon3236/CVE-2024-38472","https://github.com/mrmtwoj/apache-vulnerability-testing"],"nuclei":["CVE-2024-38472"],"checkedAt":"2026-11-05T06:38:49.869Z"},"exploitAvailable":true,"ingestedAt":"2026-11-05T06:38:03.570Z","slug":"CVE-2024-38472","body":"## Overview\n\nSSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content \nUsers are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive \"UNCList\" to allow access during request processing.\n\n## Affected\n\n- `http_server >= 2.4.0, < 2.4.60`\n- `ontap = 9`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `http_server 2.4.60`","depth":"midnight","depthScore":67,"depthScoreParts":{"impact":41.3,"likelihood":13.9,"exploitation":12,"ransomware":0},"changes":[]}