CVE-2021-40438

Apache HTTP Server 2.4.48 and earlier suffered an SSRF vulnerability allowing attackers to bypass proxy restrictions and access internal systems.

An SSRF flaw in Apache HTTP Server's mod_proxy module let attackers craft malicious URI paths to force the server to forward requests to arbitrary origin servers, bypassing security controls. DIB organizations must ensure their web infrastructure is patched to prevent attackers from using SSRF to pivot into internal networks or exfiltrate sensitive data. This vulnerability was actively exploited in the wild, highlighting the risk of relying on unpatched open-source components.

Shame score — The vulnerability was actively exploited in the wild (KEV) and affected a widely deployed open-source product, demonstrating a failure to patch known, high-severity flaws in critical infrastructure.