A security vulnerability has been identified in Apache HTTP Server, a common web server software used to run a large number of websites. This flaw is tracked as CVE-2021-40438.
The issue takes advantage of the server's mod_proxy feature, which passes incoming web requests to the backend servers that host a site's content. If an attacker sends a specially crafted, malicious web request to an affected server, they can trick this feature into forwarding the request to a server of the attacker's choosing, rather than the intended backend for the site.
This vulnerability impacts all versions of Apache HTTP Server 2.4.48 and earlier. If your website runs on an affected version of this software, this flaw could potentially be used to redirect user traffic to unintended or malicious servers, which may put your site's visitors or your site's data at risk.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2021-40438
