Apache HTTP Server path traversal exploited in Japan
Attackers are actively exploiting a path traversal/RCE flaw in Apache HTTP Server (CVE-2021-41773, CVE-2021-42013), with attacks observed in Japan; users must update to 2.4.51.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-41773 and CVE-2021-42013 as exploited in the wild.
IPA (Japan's Information-technology Promotion Agency) issued an alert regarding a path traversal vulnerability in Apache HTTP Server that allows remote attackers to access files outside the document root. The vulnerability, tracked as CVE-2021-41773, has been confirmed as actively exploited in the wild, including attacks observed within Japan, prompting urgent calls for patching.
Apache's initial fix in version 2.4.50 was found to be incomplete, leading to a second CVE (CVE-2021-42013) covering the same underlying issue, which in some configurations can escalate to remote code execution. Apache released version 2.4.51 to fully address both vulnerabilities. IPA updated its advisory twice, first to note active exploitation observed domestically, and again to reflect the insufficient patch and new version release, urging all users to update immediately.
This vulnerability affects any organization running unpatched Apache HTTP Server 2.4.49 or 2.4.50, given the software's widespread use across web infrastructure. The combination of public exploitation and an initially incomplete patch increased urgency and risk during the disclosure window.
Mentioned in this report
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2021/alert20211006.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs