CVE-2021-40438 in resf rocky linux
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
Affected software: resf rocky linux, redhat enterprise linux, redhat enterprise linux eus, redhat enterprise linux for arm 64, redhat enterprise linux for arm 64 eus, redhat enterprise linux for ibm z systems, redhat enterprise linux for ibm z systems eus, redhat enterprise linux for ibm z systems eus s390x, redhat enterprise linux for power big endian, redhat enterprise linux for power little endian
Scores
- CVSS: 9.0 (critical)
- EPSS: 100.00% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2021-12-01, used in ransomware
- Published: 2021-09-16
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): Yes, published
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.