# CVE-2024-38474: Apache HTTP Server weakness with encoded question marks in backreferences

- Exploited (CISA KEV): no
- Published: 2024-07-01
- CVSS: 8.1 HIGH (v3.1)
- EPSS: 2.5% (84th percentile)
- CWE: CWE-116

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in
directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Rule off by default | 2025-08-25 | 420 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2024-09-17 | 78 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-08-25 · new · rule 456b1e8f827b4ed89fb4a54b3bdcdbad · default Disabled
  > Apache HTTP Server - Code Execution - CVE:CVE-2024-38474. Previous action: Log. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-08-25-waf-release/

### F5

- 2024-09-17 · new · rule 200007072
  > Added: signature 200007072 "Apache mod_rewrite Filename Confusion" (Path Traversal, risk Low), systems: Apache. References: CVE-2024-39573, CVE-2024-38475, CVE-2024-38474, CVE-2024-38476.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-04-28 · updated · rule 200007072
  > Updated: signature 200007072 "Apache mod_rewrite Filename Confusion" (Path Traversal, risk Low), systems: Apache. References: CVE-2024-39573, CVE-2024-38475, CVE-2024-38474, CVE-2024-38476, CVE-2024-38473.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-05-22 · updated · rule 200007072
  > Updated: signature 200007072 "Apache mod_rewrite Filename Confusion" (Path Traversal, risk Low), systems: Apache. References: CVE-2024-39573, CVE-2024-38475, CVE-2024-38474, CVE-2024-38476, CVE-2024-38473.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-38474 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-38474