onyx

onyx --cves cve-2024-40898

CVE-2024-40898

HIGHPOCApache HTTP Server
score
<0.1
cvss
7.5
epss
1.5%
published
2024-07-18
kev added
—
first seen

Apache HTTP Server on Windows with mod_rewrite in server/vhost context contains a server-side request forgery caused by improper handling of requests, letting attackers potentially leak NTLM hashes to malicious servers, exploit requires malicious request crafted to trigger SSRF.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2024-07-18 — PublishedP2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoCXscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 1.5%2026-09-23: epss 1.5%2026-09-24: epss 1.5%2026-09-25: epss 1.5%2026-09-26: epss 1.5%2026-09-27: epss 1.5%2026-09-29: epss 1.5%2026-09-30: epss 1.5%2026-10-01: epss 1.5%2026-10-02: epss 1.5%2026-10-03: epss 1.5%2026-10-04: epss 1.5%2026-10-05: epss 1.5%2026-10-06: epss 1.5%2026-10-07: epss 1.5%2026-10-08: epss 1.5%2026-10-09: epss 1.5%2026-10-10: epss 1.5%2026-10-11: epss 1.5%2026-10-12: epss 1.5%2026-10-13: epss 1.5%2026-10-14: epss 1.5%2026-10-15: epss 1.5%2026-10-16: epss 1.5%2026-10-18: epss 1.5%2026-10-19: epss 1.5%2026-10-20: epss 1.5%2026-10-21: epss 1.5%1.5%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-918

References 3