Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2021-42013 Details

Description

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CNA: CISA-ADPCVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42013	CISA-ADP	US Government Resource
http://jvn.jp/en/jp/JVN51106450/index.html	CVE	Third Party Advisory
http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html	CVE	ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html	CVE	ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html	CVE	ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html	CVE	ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html	CVE	Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html	CVE	ExploitThird Party AdvisoryVDB Entry
https://httpd.apache.org/security/vulnerabilities_24.html	CVE	Release NotesVendor Advisory
https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E	CVE	Mailing ListPatch
https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E	CVE	Mailing List
https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E	CVE	Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/	CVE	Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/	CVE	Release Notes
https://security.gentoo.org/glsa/202208-20	CVE	Third Party Advisory
https://security.netapp.com/advisory/ntap-20211029-0009/	CVE	Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ	CVE	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	CVE	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html	CVE	PatchThird Party Advisory
https://www.povilaika.com/apache-2-4-50-exploit/	CVE	ExploitThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/07/6	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/1	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/2	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/3	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/4	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/5	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/6	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/09/1	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/11/4	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/15/3	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/16/1	CVE	Mailing ListThird Party Advisory
http://jvn.jp/en/jp/JVN51106450/index.html	[email protected]	Third Party Advisory
http://packetstormsecurity.com/files/164501/Apache-HTTP-Server-2.4.50-Path-Traversal-Code-Execution.html	[email protected]	ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164609/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html	[email protected]	ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164629/Apache-2.4.49-2.4.50-Traversal-Remote-Code-Execution.html	[email protected]	ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/164941/Apache-HTTP-Server-2.4.50-Remote-Code-Execution.html	[email protected]	ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/165089/Apache-HTTP-Server-2.4.50-CVE-2021-42013-Exploitation.html	[email protected]	Third Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/167397/Apache-2.4.50-Remote-Code-Execution.html	[email protected]	ExploitThird Party AdvisoryVDB Entry
https://httpd.apache.org/security/vulnerabilities_24.html	[email protected]	Release NotesVendor Advisory
https://lists.apache.org/thread.html/r17a4c6ce9aff662efd9459e9d1850ab4a611cb23392fc68264c72cb3%40%3Ccvs.httpd.apache.org%3E	[email protected]	Mailing ListPatch
https://lists.apache.org/thread.html/r7c795cd45a3384d4d27e57618a215b0ed19cb6ca8eb070061ad5d837%40%3Cannounce.apache.org%3E	[email protected]	Mailing List
https://lists.apache.org/thread.html/rb5b0e46f179f60b0c70204656bc52fcb558e961cb4d06a971e9e3efb%40%3Cusers.httpd.apache.org%3E	[email protected]	Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMIIEFINL6FUIOPD2A3M5XC6DH45Y3CC/	[email protected]	Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WS5RVHOIIRECG65ZBTZY7IEJVWQSQPG3/	[email protected]	Release Notes
https://security.gentoo.org/glsa/202208-20	[email protected]	Third Party Advisory
https://security.netapp.com/advisory/ntap-20211029-0009/	[email protected]	Third Party Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-httpd-pathtrv-LAzg68cZ	[email protected]	Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html	[email protected]	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2022.html	[email protected]	PatchThird Party Advisory
https://www.povilaika.com/apache-2-4-50-exploit/	[email protected]	ExploitThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/07/6	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/1	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/2	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/3	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/4	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/5	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/08/6	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/09/1	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/11/4	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/15/3	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/10/16/1	[email protected]	Mailing ListThird Party Advisory

see all 61 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name	Date Added	Due Date	Required Action
Apache HTTP Server Path Traversal Vulnerability	Nov 3, 2021	Nov 17, 2021	Apply updates per vendor instructions.

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]
NVD-CWE-Other	Weakness Not in a Standard CWE Category	[email protected]
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

Product	Versions
apache http server	2.4.49 2.4.50
CPE cpe:2.3:a:apache:http_server:2.4.49:::::::* cpe:2.3:a:apache:http_server:2.4.50:::::::* Remediation No remediation found in references.
fedoraproject fedora	34 35
CPE cpe:2.3:o:fedoraproject:fedora:34:::::::* cpe:2.3:o:fedoraproject:fedora:35:::::::* Remediation No remediation found in references.
oracle instantis enterprisetrack	17.1 17.2 17.3
CPE cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:::::::* cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:::::::* cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:::::::* Remediation No remediation found in references.
oracle jd edwards enterpriseone tools	< 9.2.6.0
CPE cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:::::::: Remediation No remediation found in references.
oracle secure backup	< 18.1.0.1.0
CPE cpe:2.3:a:oracle:secure_backup:::::::: Remediation No remediation found in references.
netapp cloud backup	All versions
CPE cpe:2.3:a:netapp:cloud_backup:-:::::::* Remediation No remediation found in references.

Change History

42 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Oct 27, 2025	Modified Analysis	[email protected]
Oct 22, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Oct 21, 2025	CVE Modified	CISA-ADP
Mar 21, 2025	Modified Analysis	[email protected]
Feb 4, 2025	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
Jul 26, 2024	Modified Analysis	[email protected]
May 14, 2024	CVE Modified	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Aug 31, 2023	Reanalysis	[email protected]
Oct 5, 2022	Modified Analysis	[email protected]
Aug 15, 2022	CVE Modified	[email protected]
Jun 9, 2022	CVE Modified	[email protected]
Jun 6, 2022	CVE Modified	[email protected]
Apr 20, 2022	CVE Modified	[email protected]
Mar 25, 2022	Modified Analysis	[email protected]
Feb 7, 2022	CVE Modified	[email protected]
Nov 30, 2021	Modified Analysis	[email protected]
Nov 29, 2021	CVE Modified	[email protected]
Nov 11, 2021	CVE Modified	[email protected]
Nov 4, 2021	Modified Analysis	[email protected]
Oct 29, 2021	CVE Modified	[email protected]
Oct 25, 2021	CVE Modified	[email protected]
Oct 16, 2021	CVE Modified	[email protected]
Oct 15, 2021	CVE Modified	[email protected]
Oct 15, 2021	Initial Analysis	[email protected]
Oct 15, 2021	CVE Modified	[email protected]
Oct 13, 2021	CVE Modified	[email protected]
Oct 13, 2021	CVE Modified	[email protected]
Oct 11, 2021	CVE Modified	[email protected]
Oct 9, 2021	CVE Modified	[email protected]
Oct 9, 2021	CVE Modified	[email protected]
Oct 8, 2021	CVE Modified	[email protected]
Oct 8, 2021	CVE Modified	[email protected]
Oct 8, 2021	CVE Modified	[email protected]
Oct 8, 2021	CVE Modified	[email protected]
Oct 7, 2021	CVE Modified	[email protected]
Oct 7, 2021	CVE Modified	[email protected]
Oct 7, 2021	CVE Modified	[email protected]

CVE-2021-42013 Details

Description

Metrics

References to Advisories, Solutions, and Tools

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO