CVE-2019-0211highunder attackCWE-416

CVE-2019-0211: high-severity vulnerability in Apache HTTP Server

Published · Updated

Follow this CVE+ Monitor Apache HTTP Server+ Monitor apache2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

83Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 65%
from disclosure to weaponsame day
Published on NVDApr 8
1st PoCApr 8
CISA KEV+940d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (3 components)
Red Hat JBoss Enterprise Web Server 2
no_fix_planned: Out of support scope
Fixed
11 products (346 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) · and others 6
fix ↗
Not affected
5 products (19 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Virtualization 4 · Red Hat Enterprise Linux 5 · Red Hat JBoss Web Server 3
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

A vulnerability in Apache HTTP Server allows scripts running with limited permissions to gain full control by manipulating internal memory structures, potentially compromising the entire server. This only affects Unix-based systems.

Technical detail

CVE-2019-0211 is a privilege escalation vulnerability in Apache HTTP Server 2.4.17–2.4.38 using MPM event, worker, or prefork. Unprivileged child processes or in-process scripts can manipulate the scoreboard structure to achieve arbitrary code execution with parent process privileges (typically root). Unix systems are affected; Windows and non-Unix platforms are not.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache · Apache HTTP Server
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache HTTP Server

In the same product, most dangerous first.

CVE-2020-1927—CVE-2020-1927EPSS 56.7%CVE-2020-1934—CVE-2020-1934EPSS 52.0%CVE-2019-0217—CVE-2019-0217EPSS 16.4%CVE-2019-0215—CVE-2019-0215EPSS 10.4%