CVE-2024-40725

A flaw was found in httpd. The fix for CVE-2024-39884 ignores some uses of the legacy content-type based configuration of handlers. "AddType" and similar configurations, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

The httpd package as shipped in Red Hat Enterprise Linux 6, 7, 8, 9 and in Red Hat JBoss Core Services is not affected by this vulnerability because the vulnerable code was introduced in a newer version of httpd.

This flaw allows unauthenticated remote users to view local content that was not intended to be served or shared, such as PHP scripts. As the disclosed information presents a serious impact to confidentiality, this flaw has been rated with an important severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.