Apache Http Server vulnerabilities

5 vulnerabilities

Known vulnerabilities in Apache Http Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2020-1934apacheapache_http_server+14
EPSS score
51.95%
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.6.1CVE-2020-1927apacheapache_http_server+17
EPSS score
56.69%
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.7.5CVE-2019-0217apacheapache_http_server+17
EPSS score
17.43%
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.7.5CVE-2019-0215apacheapache_http_server+4
EPSS score
10.69%
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.7.8CVE-2019-0211apacheapache_http_server+30KEV
EPSS score
65.00%
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.