CVE-2021-40438 CISA KEV · Actively exploitedLinked to ransomwareSuited to automated attack · CISA
mod_proxy SSRF
CVSS score
9.0
EPSS probability
%100.0
Risk score
18.0
Published
5 y ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
Check Point Security Gateways RCE via CVE-2021-40438
Makefile Go / Python
Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery
Makefile Go / Python
CVE-2021-40438 Apache <= 2.4.48 SSRF exploit
Makefile Go / Python
Sigma-Rule-for-CVE-2021-40438-Attack-Attemp
Makefile Go / Python
GitHub
Dockerized Proof-of-Concept of CVE-2021-40438 in Apache 2.4.48.
Makefile Go / Python
GitHub
CVE-2021-40438 exploit PoC with Docker setup.
Makefile Go / Python
Nuclei: Apache <= 2.4.48 Mod_Proxy - Server-Side Request Forgery
Makefile Go / Python
Similar Vulnerabilities
10.0
CVE-2021-44228 Actively exploited
Improper input validation in Apache Log4j
S
Patch verified Public Exploits:22EPSS %100
10.0
CVE-2015-3306 Actively exploited
Improper access control in N/a
N
Workaround Public Exploits:5EPSS %99
9.8
CVE-2017-5638 Actively exploited
struts2: RCE when performing file upload based on Jakarta Multipart parser
A
Workaround Public Exploits:10EPSS %100
9.8
CVE-2018-11776 Actively exploited
struts2: Using specific results and namespaces can result in a remote code execution
A
Workaround Public Exploits:14EPSS %100
9.8
CVE-2023-46604 Actively exploited
activemq-openwire: OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
RH
Partial patch Public Exploits:9EPSS %100
9.8
CVE-2025-61882 Actively exploited
Improper authentication in Oracle Corporation Oracle Concurrent Processing
OC
Workaround Public Exploits:1EPSS %100
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2021-40438"