Cyber Resilience

CVE-2024-39884

Apache Http Server 2.4.60

Published
04 July 2024
Modified
01 July 2025
Patch / advisory
View advisory
CVSS Score v3.1 6.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0089 56th percentile
Risk Priority 50 floored blend · peak EPSS

Summary

CVE-2024-39884 is a medium-severity an unspecified weakness vulnerability in Apache Http Server. Its CVSS base score is 6.2 (Medium).

Operationally, ranked in the top 44% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local…

more

content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.

CWE(s)
NVD-CWE-noinfo

Related Threats

CVEs Like This One

CVE-2024-38477Same product: Apache Http Server
CVE-2024-38474Same product: Apache Http Server
CVE-2024-34750Same product: Netapp Ontap Tools
CVE-2024-38286Same product: Netapp Ontap Tools
CVE-2025-27820Same product: Netapp Ontap Tools
CVE-2024-38476Same product: Apache Http Server
CVE-2024-38473Same product: Apache Http Server
CVE-2024-39573Same product: Apache Http Server
CVE-2024-36387Same product: Apache Http Server
CVE-2024-38472Same product: Apache Http Server

Affected Assets

apache
http server
2.4.60
netapp
ontap tools
10

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References