CVE-2024-38473: 
Apache HTTP Server vulnerability analysis and mitigation

A moderate severity vulnerability (CVE-2024-38473) was identified in the mod_proxy module of Apache HTTP Server versions 2.4.59 and earlier. The vulnerability stems from an encoding problem that allows request URLs with incorrect encoding to be sent to backend services (Apache Httpd, CVE Mitre).

The vulnerability affects configurations where mechanisms other than ProxyPass/ProxyPassMatch or RewriteRule with the 'P' flag are used to configure a request to be proxied, such as SetHandler or inadvertent proxying. This includes configurations where these alternate mechanisms may be used within .htaccess files. The issue allows request URLs with incorrect encoding to be sent to backend services (Apache Httpd).

When successfully exploited, this vulnerability could potentially lead to authentication bypass via crafted requests. The vulnerability has been assigned a CVSS score of 8.1 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (NetApp Security).

The vulnerability requires a low level of access privileges and no user interaction for exploitation. The attack can be launched remotely over the network, making it relatively accessible to potential attackers (NetApp Security).

Users are recommended to upgrade to Apache HTTP Server version 2.4.60, which contains the fix for this vulnerability. The issue was reported by Orange Tsai (@orange_8361) from DEVCORE and was fixed in version 2.4.60 released on July 1, 2024 (Apache Httpd).