9.8
CVE-2021-44790
- EPSS 87.09%
- Veröffentlicht 20.12.2021 12:15:07
- Zuletzt bearbeitet 01.05.2025 15:38:06
- Quelle security@apache.org
- Teams Watchlist Login
- Unerledigt Login
A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ HTTP Server Version < 2.4.52
Fedoraproject ≫ Fedora Version34
Fedoraproject ≫ Fedora Version35
Fedoraproject ≫ Fedora Version36
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version11.0
Tenable ≫ Tenable.Sc Version >= 5.16.0 < 5.20.0
Netapp ≫ Cloud Backup Version-
Oracle ≫ Communications Element Manager Version <= 9.0
Oracle ≫ Communications Operations Monitor Version4.3
Oracle ≫ Communications Operations Monitor Version4.4
Oracle ≫ Communications Operations Monitor Version5.0
Oracle ≫ Communications Session Report Manager Version <= 9.0
Oracle ≫ Communications Session Route Manager Version <= 9.0
Oracle ≫ HTTP Server Version12.2.1.3.0
Oracle ≫ HTTP Server Version12.2.1.4.0
Oracle ≫ Instantis Enterprisetrack Version17.1
Oracle ≫ Instantis Enterprisetrack Version17.2
Oracle ≫ Instantis Enterprisetrack Version17.3
Oracle ≫ Zfs Storage Appliance Kit Version8.8
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 87.09% | 0.994 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-787 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.