---
id: CVE-2024-38472
title: "SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and\_malicious requests or content \nUsers are recommended to upgrade to version 2.4.60 which fixes this issue.\_ Note: Existing con…"
summary: "SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and\_malicious requests or content \nUsers are recommended to upgrade to version 2.4.60 which fixes this issue.\_ Note: Existing con…"
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-918
vendor: apache
product: http_server
affected:
  - 'http_server >= 2.4.0, < 2.4.60'
  - ontap = 9
patched:
  - http_server 2.4.60
published: '2024-07-01'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T22:17:21.750'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-38472'
references:
  - url: 'https://httpd.apache.org/security/vulnerabilities_24.html'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2024/07/01/5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://httpd.apache.org/security/vulnerabilities_24.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20240712-0001/'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2024-07-26T03:55:31.579855Z'
epss: 0.6947
epssPercentile: 0.99364
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/Abdurahmon3236/CVE-2024-38472'
    - 'https://github.com/mrmtwoj/apache-vulnerability-testing'
  nuclei:
    - CVE-2024-38472
  checkedAt: '2026-11-05T06:38:49.869Z'
exploitAvailable: true
ingestedAt: '2026-11-05T06:38:03.570Z'
---

## Overview

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content 
Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

## Affected

- `http_server >= 2.4.0, < 2.4.60`
- `ontap = 9`

## Remediation

Upgrade past the affected range:

- `http_server 2.4.60`