/** * This is the notes section. CVE documents should ONLY be created by employees of ClearCenter with the authority to make statements on behalf of the company. If you have content that would be useful to the statement, please contact ClearCenter. */
'In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.'
The '<FilesMatch>' parameter specified by this vulnerability is NOT enabled by default in ClearOS. Further, this parameter is not tunable to be made available via ClearOS' Webconfig. If you have manually turned this parameter on, disable it.
The '<FilesMatch>' parameter specified by this vulnerability is NOT enabled by default in ClearOS. Further, this parameter is not tunable to be made available via ClearOS' Webconfig nor does any app in the ClearOS Marketplace require that this parameter be enabled. Users of ClearOS' Webconfig or ClearOS' Web Server would have to be enabled by the user in command line. If you are using custom code that has required you to manipulate this value, please disable it.
If you have enabled '<FilesMatch>' through custom editing of ClearOS via command line, disable it.