VULNERABILITY INTELLIGENCE

CVE-2024-39884

CVSS score6.2 MEDIUM
EPSS probability0.89%
CISA KEVNot currently listed
Published2024-07-04
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers.   "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.

Weakness classification

  • nvd@nist.gov: NVD-CWE-noinfo

Primary references