Cyber Resilience

CVE-2021-44224

High

Published: 20 December 2021

Published
20 December 2021
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS Score 0.0925 92.9th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-44224 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Apple Mac Os X. Its CVSS base score is 8.2 (High).

Operationally, ranked in the top 7.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix…

more

Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

CWE(s)
CWE-476

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

apache
http server
2.4.7 — 2.4.52
fedoraproject
fedora
34, 35, 36
debian
debian linux
10.0, 11.0
tenable
tenable.sc
5.14.0 — 5.20.0 · 5.16.0 — 202201.1
oracle
communications element manager
≤ 9.0
oracle
communications operations monitor
4.0, 4.3, 4.4, 5.0
oracle
communications session report manager
≤ 9.0
oracle
communications session route manager
≤ 9.0
oracle
http server
12.2.1.3.0, 12.2.1.4.0, all versions
oracle
instantis enterprisetrack
17.1, 17.2, 17.3
+2 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References