Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) (CVE-2021-42013)

路径遍历 / 路径遍历 / #1400238

厂商

Internet Bug Bounty

严重程度

高危

赏金

$1,000

弱点

路径遍历

研究员

@fms

披露日期

2021-11-19

资产

https://github.com/apache/httpd

CVE

CVE-2021-41773CVE-2021-42013

该报告还没有中文解读。

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives.