CVE-2021-42013 is a path traversal vulnerability in Apache HTTP Server. CISA added it to the Known Exploited Vulnerabilities catalogue on 3 November 2021, which means attackers have used it in real attacks. This CVE ID resolves an incomplete patch for CVE-2021-41773.
What this vulnerability means in practice
CVE-2021-42013 is dangerous because a path traversal flaw in a web server can let an attacker reach files outside the intended web root, turning a simple request-handling bug into unauthorized file access or, in some deployments, code execution. Because this CVE is the incomplete fix for CVE-2021-41773, organisations should treat the two issues as closely related when assessing exposure and remediation.
For authoritative version and patch details, use the CVE Program record and the NIST National Vulnerability Database entry rather than relying on secondary summaries.
How organisations check exposure
Exposure checks start with a complete inventory of Apache HTTP Server instances, including forgotten test systems, reverse proxies, and internet-facing hosts that may still be reachable. From there, confirm whether the server is externally exposed, whether it is used to serve dynamic content or administrative functions, and whether vendor advisories or internal scanning have identified the vulnerable condition.
That assessment is most effective when it is tied to asset ownership and vulnerability prioritisation. NHIMG’s Vulnerability Management Guide is a useful companion for thinking about scope, prioritisation, remediation exceptions, and verification after a fix.
Remediation and compensating controls
The preferred response is to apply the vendor’s fix as soon as operationally possible, but organisations often need interim controls when patching is delayed. In that situation, reduce attack surface by limiting internet exposure, tightening access at the edge, removing unneeded modules or features, and restricting which paths and directories the server can reach.
Where a patch cannot be deployed immediately, compensating controls should focus on blocking traversal attempts and reducing blast radius rather than assuming the vulnerability is harmless because no compromise has been observed yet. The practical goal is to make exploitation harder while the vulnerable service remains online.
Detection and compromise review
Because this issue can be actively exploited, defenders should review web logs, reverse proxy logs, and file-access telemetry for suspicious path traversal sequences, unusual requests for configuration or source files, and signs that the server accessed content it should never normally expose. If exploitation is suspected, review nearby activity for follow-on changes, dropped files, or additional access to secrets and credentials.
Post-patch review matters because fixing the software does not remove what an attacker may already have obtained. If the server was compromised, rotate any credentials, tokens, keys, or administrative material reachable from the affected system, and treat the incident as an exposure event, not just a patching task.
Risk and Threat Considerations
Path traversal vulnerabilities on public web servers are attractive to attackers because they can expose configuration files, application code, and other sensitive local resources that should never be web-reachable. In an internet-facing service, even a narrow traversal bug can become a stepping stone to credential theft, information disclosure, or deeper compromise.
Failure mechanism: The attacker manipulates request paths so the server resolves a location outside the intended document root, bypassing file-boundary assumptions and reading or using resources that were meant to stay local.
Impact: Successful exploitation can reveal secrets, enable lateral compromise, or provide the foothold needed for code execution and broader environment access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Path traversal is enabled by unsafe path handling and weak input validation. |
| CM-7 — Least Functionality | Reducing exposed server features limits traversal opportunities and attack surface. | |
| RA-5 — Vulnerability Monitoring and Scanning | This CVE requires active exposure discovery and verification across assets. | |
| Recommendation — Validate and canonicalize request paths before they reach the filesystem. Disable unnecessary modules, endpoints, and file access paths. Continuously scan Apache assets for vulnerable exposure and confirm remediation. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | The issue requires asset inventory, prioritisation, and remediation tracking. |
| Recommendation — Prioritise exposed Apache hosts and verify remediation through continuous scanning. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Traversal defects reflect unsafe request handling and insecure filesystem access design. |
| Recommendation — Enforce secure path handling and reject user-controlled traversal sequences. | ||
Practitioner Guidance
Why practitioners should care: Treat path traversal on a core web server as a high-priority exposure because it can turn a basic content-serving component into a route to sensitive files and downstream trust loss. Verify not only whether the patch is installed, but whether the server is still reachable in a way that makes exploitation practical.
What to watch for: Watch for request patterns that attempt directory navigation, unexpected access to server-side files, and any evidence that the server has handled requests outside its normal content tree. If there is any sign of exploitation, assume secrets and session material may need review even if the web service still appears functional.