PUBLISHED
2025-12-05 11:15
MODIFIED
2025-12-05 11:15
EPSS (Prob. Exploit)
0.88%
Top 40.7%
> DESCRIPTION
Server-Side Request Forgery (SSRF) vulnerability
in Apache HTTP Server on Windows
with AllowEncodedSlashes On and MergeSlashes Off allows to potentially leak NTLM
hashes to a malicious server via SSRF and malicious requests or content
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-918: Server-Side Request Forgery - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF
ALIASES:
BIT-apache-2025-59775
> HISTORIQUE DES MODIFICATIONS
Première apparition
05/12/2025 11:15
Source: NVD
📊
ENRICHISSEMENT
01/11/2026 06:58
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-918: Server-Side Request Forgery (SSRF) - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure th...
Nouvelle valeur:
CWE-918: Server-Side Request Forgery - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the ...
📊
ENRICHISSEMENT
19/01/2026 17:37
CVEPROJECT
Champ modifié: CVE Project
📊
ENRICHISSEMENT
01/01/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-918: Server-Side Request Forgery (SSRF) - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure th...
Total des modifications: 3
Dernière mise à jour: 1 week ago