cscli scenarios install crowdsecurity/http-cve-2021-420131type: trigger2format: 2.03#debug: true4#this is getting funny, it's the third patch on top of cve-2021-417735name: crowdsecurity/http-cve-2021-420136description: "Apache - Path Traversal (CVE-2021-42013)"7filter: |8 evt.Meta.log_type in ["http_access-log", "http_error-log"] and9 Upper(evt.Meta.http_path) contains "/%%32%65%%32%65/"10groupby: "evt.Meta.source_ip"11blackhole: 2m12labels:13 service: apache14 confidence: 315 spoofable: 016 classification:17 - attack.T119018 - attack.T159519 - cve.CVE-2021-4201320 behavior: "http:exploit"21 label: "CVE-2021-42013"22 remediation: true23