CVE-2020-11984observed exploitation

CVE-2020-11984

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 90%

from disclosure to weapon1788 days

Published on NVDAug 7

1st PoC+1788d

VulnCheck+564d

exploitation probability

90%top 1% of all CVEs

observed exploitation

yesVulnCheck

1 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Affected

1 product (3 components)

Red Hat JBoss Enterprise Web Server 2

workaround: This flaw only affects specific httpd configurations which use the uwsgi protocol. It does not manifest itself when uwsgi protocol is not used. Commenting out "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" in…

Fixed

8 products (361 components)

Red Hat JBoss Core Services on RHEL 6 Server · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat JBoss Core Services on RHEL 7 Server · Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) · and others 3

fix ↗

Not affected

3 products (16 components) — because the vulnerable code is not present in the product

Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 5

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

Affected products

n/a · Apache HTTP Server

public PoCs found — 1

vulncheckvulncheck.com/xdb/9f4dd9acdf55unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References