Homepage

Server-Side Request Forgery (SSRF) The advisory has been revoked - it doesn't affect any version of package apache2-data  (opens in a new tab)

Threat Intelligence

EPSS
1.27% (70th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-APACHE2DATA-13137828
  • published29 Sept 2025
  • disclosed10 Jul 2025
Report a new vulnerability Found a mistake?

Introduced: 10 Jul 2025

CVE-2024-43394  (opens in a new tab)
CWE-918  (opens in a new tab)

Amendment

The Minimos security team deemed this advisory irrelevant for Minimos:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache2-data package and not the apache2-data package as distributed by Minimos.

Server-Side Request Forgery (SSRF) in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via  mod_rewrite or apache expressions that pass unvalidated request input.

This issue affects Apache HTTP Server: from 2.4.0 through 2.4.63.

Note:  The Apache HTTP Server Project will be setting a higher bar for accepting vulnerability reports regarding SSRF via UNC paths.

The server offers limited protection against administrators directing the server to open UNC paths. Windows servers should limit the hosts they will connect over via SMB based on the nature of NTLM authentication.