October 8, 2021

The Apache Software Foundation has fixed two vulnerabilities, one of which has been actively exploited path traversal and file disclosure flaw in a recently released version 2.4.50 of the HTTP Web Server (an open source, cross-platform web server) and the second vulnerability, a zero pointer deference tracked as CVE-2021-41524.

The zero-day vulnerability in question, traced as CVE-2021-41773, allows attackers to map URL files outside the expected document root by launching a path traversal attack. The attack involves sending requests to access backend or sensitive server directories that are normally out of reach, causing interpreted files such as CGI scripts leak.

The second vulnerability, discovered while processing HTTP/2 requests three weeks ago, allows attackers to perform a DDoS attack on a server. Though it is not being actively exploited, it has also been infected in the current version 2.4.50, after it was discovered in late September.

For more information, read the original story in Bleeping Computer.