CVE-2024-39884
MediumSummary
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content.
Risk Assessment
An attacker can access application source code, potentially revealing sensitive information such as passwords or business logic, facilitating further attacks.
Recommendation
Review handler configurations and apply appropriate fixes or temporarily disable unsafe configurations.
Original NVD description (English source)
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP