{"meta":{"title":"KEV entries: Apache","description":"All KEV entries for vendor Apache.","source":"CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)","catalogVersion":"2026.09.23","catalogDateReleased":"2026-09-23T12:51:35.821Z","referenceDate":"2026-09-23","publisher":"Telemetry","license":"https://creativecommons.org/licenses/by/4.0/","documentation":"https://glide-telemetry.pages.dev/api/","records":40,"vendor":"Apache","entries":40,"shareOfCatalogPercent":2.3,"ransomwareKnown":8,"firstDateAdded":"2021-11-03","latestDateAdded":"2026-08-04","rank":7},"data":[{"cveID":"CVE-2026-34486","vendorProject":"Apache","product":"Tomcat","vulnerabilityName":"Apache Tomcat Missing Encryption of Sensitive Data Vulnerability","dateAdded":"2026-08-04","dueDate":"2026-08-07","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-311"],"shortDescription":"Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-34486","telemetryUrl":"https://glide-telemetry.pages.dev/kev/cve-2026-34486/"},{"cveID":"CVE-2026-34197","vendorProject":"Apache","product":"ActiveMQ","vulnerabilityName":"Apache ActiveMQ Improper Input Validation Vulnerability","dateAdded":"2026-04-16","dueDate":"2026-04-30","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20","CWE-94"],"shortDescription":"Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://activemq.apache.org/security-advisories.data/CVE-2026-34197-announcement.txt ; https://nvd.nist.gov/vuln/detail/CVE-2026-34197","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2026/#cve-2026-34197"},{"cveID":"CVE-2024-38475","vendorProject":"Apache","product":"HTTP Server","vulnerabilityName":"Apache HTTP Server Improper Escaping of Output Vulnerability","dateAdded":"2025-05-01","dueDate":"2025-05-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-116"],"shortDescription":"Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://httpd.apache.org/security/vulnerabilities_24.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-38475","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-38475"},{"cveID":"CVE-2025-24813","vendorProject":"Apache","product":"Tomcat","vulnerabilityName":"Apache Tomcat Path Equivalence Vulnerability","dateAdded":"2025-04-01","dueDate":"2025-04-22","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-44","CWE-502"],"shortDescription":"Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request. This vulnerability can be chained with CVE‑2026‑34486.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq ; https://nvd.nist.gov/vuln/detail/CVE-2025-24813","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2025-24813"},{"cveID":"CVE-2024-45195","vendorProject":"Apache","product":"OFBiz","vulnerabilityName":"Apache OFBiz Forced Browsing Vulnerability","dateAdded":"2025-02-04","dueDate":"2025-02-25","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-425"],"shortDescription":"Apache OFBiz contains a forced browsing vulnerability that allows a remote attacker to obtain unauthorized access.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://ofbiz.apache.org/security.html ; https://nvd.nist.gov/vuln/detail/CVE-2024-45195","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2025/#cve-2024-45195"},{"cveID":"CVE-2024-27348","vendorProject":"Apache","product":"HugeGraph-Server","vulnerabilityName":"Apache HugeGraph-Server Improper Access Control Vulnerability","dateAdded":"2024-09-18","dueDate":"2024-10-09","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-284"],"shortDescription":"Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see:  https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9 ; https://nvd.nist.gov/vuln/detail/CVE-2024-27348","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-27348"},{"cveID":"CVE-2024-38856","vendorProject":"Apache","product":"OFBiz","vulnerabilityName":"Apache OFBiz Incorrect Authorization Vulnerability","dateAdded":"2024-08-27","dueDate":"2024-09-17","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-863"],"shortDescription":"Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w; https://nvd.nist.gov/vuln/detail/CVE-2024-38856","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-38856"},{"cveID":"CVE-2024-32113","vendorProject":"Apache","product":"OFBiz","vulnerabilityName":"Apache OFBiz Path Traversal Vulnerability","dateAdded":"2024-08-07","dueDate":"2024-08-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-22"],"shortDescription":"Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd; https://nvd.nist.gov/vuln/detail/CVE-2024-32113","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2024-32113"},{"cveID":"CVE-2020-17519","vendorProject":"Apache","product":"Flink","vulnerabilityName":"Apache Flink Improper Access Control Vulnerability","dateAdded":"2024-05-23","dueDate":"2024-06-13","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-552"],"shortDescription":"Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/typ0h03zyfrzjqlnb7plh64df1g2383d; https://nvd.nist.gov/vuln/detail/CVE-2020-17519","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2020-17519"},{"cveID":"CVE-2023-27524","vendorProject":"Apache","product":"Superset","vulnerabilityName":"Apache Superset Insecure Default Initialization of Resource Vulnerability","dateAdded":"2024-01-08","dueDate":"2024-01-29","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-1188"],"shortDescription":"Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk;  https://nvd.nist.gov/vuln/detail/CVE-2023-27524","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2024/#cve-2023-27524"},{"cveID":"CVE-2023-46604","vendorProject":"Apache","product":"ActiveMQ","vulnerabilityName":"Apache ActiveMQ Deserialization of Untrusted Data Vulnerability","dateAdded":"2023-11-02","dueDate":"2023-11-23","knownRansomwareCampaignUse":"Known","cwes":["CWE-502"],"shortDescription":"Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network access to a broker to run shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt; https://nvd.nist.gov/vuln/detail/CVE-2023-46604","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-46604"},{"cveID":"CVE-2023-33246","vendorProject":"Apache","product":"RocketMQ","vulnerabilityName":"Apache RocketMQ Command Execution Vulnerability","dateAdded":"2023-09-06","dueDate":"2023-09-27","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp;  https://nvd.nist.gov/vuln/detail/CVE-2023-33246","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2023-33246"},{"cveID":"CVE-2016-8735","vendorProject":"Apache","product":"Tomcat","vulnerabilityName":"Apache Tomcat Remote Code Execution Vulnerability","dateAdded":"2023-05-12","dueDate":"2023-06-02","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-284"],"shortDescription":"Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.","requiredAction":"Apply updates per vendor instructions.","notes":"https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2016-8735"},{"cveID":"CVE-2021-45046","vendorProject":"Apache","product":"Log4j2","vulnerabilityName":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","dateAdded":"2023-05-01","dueDate":"2023-05-22","knownRansomwareCampaignUse":"Known","cwes":["CWE-917"],"shortDescription":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.","requiredAction":"Apply updates per vendor instructions.","notes":"https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2021-45046"},{"cveID":"CVE-2022-33891","vendorProject":"Apache","product":"Spark","vulnerabilityName":"Apache Spark Command Injection Vulnerability","dateAdded":"2023-03-07","dueDate":"2023-03-28","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.","requiredAction":"Apply updates per vendor instructions.","notes":"https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc;  https://nvd.nist.gov/vuln/detail/CVE-2022-33891","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2023/#cve-2022-33891"},{"cveID":"CVE-2022-24706","vendorProject":"Apache","product":"CouchDB","vulnerabilityName":"Apache CouchDB Insecure Default Initialization of Resource Vulnerability","dateAdded":"2022-08-25","dueDate":"2022-09-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-1188"],"shortDescription":"Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to escalate to administrative privileges.","requiredAction":"Apply updates per vendor instructions.","notes":"https://lists.apache.org/thread/w24wo0h8nlctfps65txvk0oc5hdcnv00;  https://nvd.nist.gov/vuln/detail/CVE-2022-24706","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-24706"},{"cveID":"CVE-2022-24112","vendorProject":"Apache","product":"APISIX","vulnerabilityName":"Apache APISIX Authentication Bypass Vulnerability","dateAdded":"2022-08-25","dueDate":"2022-09-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-290"],"shortDescription":"Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://lists.apache.org/thread/lcdqywz8zy94mdysk7p3gfdgn51jmt94;  https://nvd.nist.gov/vuln/detail/CVE-2022-24112","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2022-24112"},{"cveID":"CVE-2020-1956","vendorProject":"Apache","product":"Kylin","vulnerabilityName":"Apache Kylin OS Command Injection Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1956","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-1956"},{"cveID":"CVE-2017-12617","vendorProject":"Apache","product":"Tomcat","vulnerabilityName":"Apache Tomcat Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-434"],"shortDescription":"When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-12617","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-12617"},{"cveID":"CVE-2017-12615","vendorProject":"Apache","product":"Tomcat","vulnerabilityName":"Apache Tomcat on Windows Remote Code Execution Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-434"],"shortDescription":"When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-12615","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-12615"},{"cveID":"CVE-2013-2251","vendorProject":"Apache","product":"Struts","vulnerabilityName":"Apache Struts Improper Input Validation Vulnerability","dateAdded":"2022-03-25","dueDate":"2022-04-15","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-2251","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2013-2251"},{"cveID":"CVE-2020-1938","vendorProject":"Apache","product":"Tomcat","vulnerabilityName":"Apache Tomcat Improper Privilege Management Vulnerability","dateAdded":"2022-03-03","dueDate":"2022-03-17","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-1938","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-1938"},{"cveID":"CVE-2017-9791","vendorProject":"Apache","product":"Struts 1","vulnerabilityName":"Apache Struts 1 Improper Input Validation Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-9791","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2017-9791"},{"cveID":"CVE-2016-3088","vendorProject":"Apache","product":"ActiveMQ","vulnerabilityName":"Apache ActiveMQ Improper Input Validation Vulnerability","dateAdded":"2022-02-10","dueDate":"2022-08-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-3088","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2016-3088"},{"cveID":"CVE-2012-0391","vendorProject":"Apache","product":"Struts 2","vulnerabilityName":"Apache Struts 2 Improper Input Validation Vulnerability","dateAdded":"2022-01-21","dueDate":"2022-07-21","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-0391","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2012-0391"},{"cveID":"CVE-2006-1547","vendorProject":"Apache","product":"Struts 1","vulnerabilityName":"Apache Struts 1 ActionForm Denial-of-Service Vulnerability","dateAdded":"2022-01-21","dueDate":"2022-07-21","knownRansomwareCampaignUse":"Unknown","cwes":[],"shortDescription":"ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS).","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2006-1547","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2006-1547"},{"cveID":"CVE-2020-13927","vendorProject":"Apache","product":"Airflow's Experimental API","vulnerabilityName":"Apache Airflow's Experimental API Authentication Bypass","dateAdded":"2022-01-18","dueDate":"2022-07-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-1188","CWE-306"],"shortDescription":"The previous default setting for Airflow's Experimental API was to allow all API requests without authentication.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-13927","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-13927"},{"cveID":"CVE-2020-11978","vendorProject":"Apache","product":"Airflow","vulnerabilityName":"Apache Airflow Command Injection","dateAdded":"2022-01-18","dueDate":"2022-07-18","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-78"],"shortDescription":"A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-11978","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2022/#cve-2020-11978"},{"cveID":"CVE-2021-44228","vendorProject":"Apache","product":"Log4j2","vulnerabilityName":"Apache Log4j2 Remote Code Execution Vulnerability","dateAdded":"2021-12-10","dueDate":"2021-12-24","knownRansomwareCampaignUse":"Known","cwes":["CWE-20","CWE-400","CWE-502"],"shortDescription":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-44228"},{"cveID":"CVE-2019-0193","vendorProject":"Apache","product":"Solr","vulnerabilityName":"Apache Solr DataImportHandler Code Injection Vulnerability","dateAdded":"2021-12-10","dueDate":"2022-06-10","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-94"],"shortDescription":"The optional Apache Solr module DataImportHandler contains a code injection vulnerability.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0193","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0193"},{"cveID":"CVE-2021-40438","vendorProject":"Apache","product":"Apache","vulnerabilityName":"Apache HTTP Server-Side Request Forgery (SSRF)","dateAdded":"2021-12-01","dueDate":"2021-12-15","knownRansomwareCampaignUse":"Known","cwes":["CWE-918"],"shortDescription":"A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-40438","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-40438"},{"cveID":"CVE-2021-42013","vendorProject":"Apache","product":"HTTP Server","vulnerabilityName":"Apache HTTP Server Path Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-42013","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-42013"},{"cveID":"CVE-2021-41773","vendorProject":"Apache","product":"HTTP Server","vulnerabilityName":"Apache HTTP Server Path Traversal Vulnerability","dateAdded":"2021-11-03","dueDate":"2021-11-17","knownRansomwareCampaignUse":"Known","cwes":["CWE-22"],"shortDescription":"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default �require all denied� or if CGI scripts are enabled. The original patch issued under this CVE ID is insufficient, please review remediation information under CVE-2021-42013.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-41773","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2021-41773"},{"cveID":"CVE-2020-17530","vendorProject":"Apache","product":"Struts","vulnerabilityName":"Apache Struts Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-917"],"shortDescription":"Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-17530","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2020-17530"},{"cveID":"CVE-2019-17558","vendorProject":"Apache","product":"Solr","vulnerabilityName":"Apache Solr VelocityResponseWriter Plug-In Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-74"],"shortDescription":"The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-17558","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-17558"},{"cveID":"CVE-2019-0211","vendorProject":"Apache","product":"HTTP Server","vulnerabilityName":"Apache HTTP Server Privilege Escalation Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-416"],"shortDescription":"Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-0211","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2019-0211"},{"cveID":"CVE-2018-11776","vendorProject":"Apache","product":"Struts","vulnerabilityName":"Apache Struts Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-20"],"shortDescription":"Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuration have no or wildcard namespace.  Or, using URL tag which doesn't have value and action set and in same time, its upper package configuration have no or wildcard namespace.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-11776","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2018-11776"},{"cveID":"CVE-2017-9805","vendorProject":"Apache","product":"Struts","vulnerabilityName":"Apache Struts Deserialization of Untrusted Data Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-502"],"shortDescription":"Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-9805","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-9805"},{"cveID":"CVE-2017-5638","vendorProject":"Apache","product":"Struts","vulnerabilityName":"Apache Struts Remote Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","cwes":["CWE-20"],"shortDescription":"Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-5638","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2017-5638"},{"cveID":"CVE-2016-4437","vendorProject":"Apache","product":"Shiro","vulnerabilityName":"Apache Shiro Code Execution Vulnerability","dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","cwes":["CWE-284"],"shortDescription":"Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the \"remember me\" feature.","requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2016-4437","telemetryUrl":"https://glide-telemetry.pages.dev/kev/2021/#cve-2016-4437"}]}