# MA-819.102021: MyCERT Alert - Critical Vulnerability in Apache HTTP Server

**Date:** 13 Oct 2021  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-819.102021  
**Advisory ID:** MA-819.102021

---

**1.0 Introduction**
Apache has released Apache HTTP Server version 2.4.51 to address a critical vulnerabilities (CVE-2021-41773 and CVE-2021-42013) found in their HTTP server. This vulnerability allows attackers to map URLs to files easily via a path traversal attack and remote code execution.
**2.0 Impact**
Exploiting this vulnerability may allow an attacker to gain access to arbitrary files on the affected server.
**3.0 Affected System and Devices**
This vulnerability affects only version 2.4.49 and Apache 2.4.50 and not earlier versions of the Apache HTTP Server.
**4.0 Recommendations**
To mitigate CVE-2021-41773 and CVE-2021-42013, MyCERT strongly urges critical infrastructure entities and other organizations with affected HTTP Server versions to upgrade to the latest version immediately. Kindly refer to the below URL:
<https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-42013>
<https://httpd.apache.org/download.cgi#apache24>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://us-cert.cisa.gov/ncas/current-activity/2021/10/06/apache-releases-security-update-apache-http-server>
- <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42013>
- <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41773>
- <https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-42013>
- <https://blog.sonatype.com/apache-servers-actively-exploited-in-wild-importance-of-prompt-patching>
- <https://www.tenable.com/blog/cve-2021-41773-path-traversal-zero-day-in-apache-http-server-exploited>