CVE-2019-0211: Apache HTTP Server Privilege Escalation, actively exploited

Description

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Apache HTTP Server≥ 2.4.17 ≤ 2.4.38

Netapp Oncommand Unified Managerall versions

Oracle Communications Session Report Manager8.0.0 · 8.1.0 · 8.1.1 · 8.2.0

Oracle Communications Session Route Manager8.0.0 · 8.1.0 · 8.1.1 · 8.2.0

Oracle Enterprise Manager Ops Center12.3.3 · 12.4.0

Oracle HTTP Server12.2.1.3.0

Oracle Instantis Enterprisetrack17.1 · 17.2 · 17.3

Oracle Retail Xstore Point Of Service7.0 · 7.1

Redhat Jboss Core Services1.0

Redhat Openshift Container Platform3.11

Redhat Openshift Container Platform For Power3.11_ppc64le

Redhat Software Collections1.0

Canonical Ubuntu Linux14.04 · 16.04 · 18.04 · 18.10

Debian Linux9.0

Fedoraproject Fedora28 · 29 · 30

Opensuse Leap15.0 · 42.3

Redhat Enterprise Linux8.0

Redhat Enterprise Linux Eus8.1 · 8.2 · 8.4 · 8.6

Redhat Enterprise Linux For Arm 648.0_aarch64

Redhat Enterprise Linux For Arm 64 Eus8.1_aarch64 · 8.2_aarch64 · 8.4_aarch64 · 8.6_aarch64

Redhat Enterprise Linux For Ibm Z Systems8.0_s390x

Redhat Enterprise Linux For Ibm Z Systems Eus8.1_s390x · 8.2_s390x · 8.4_s390x · 8.6_s390x

Redhat Enterprise Linux For Power Little Endian8.0_ppc64le

Redhat Enterprise Linux For Power Little Endian Eus8.1_ppc64le · 8.2_ppc64le · 8.4_ppc64le · 8.6_ppc64le

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.htmlBroken LinkMailing ListRelease NotesThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.htmlBroken LinkMailing ListRelease NotesThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.htmlBroken LinkThird Party Advisory
http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.htmlThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.htmlExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.htmlExploitThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHBA-2019:0959Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0746Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0980Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1296Third Party Advisory

and 42 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2019-0211 being actively exploited?

Yes. CVE-2019-0211 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 3 Nov 2021.

How severe is CVE-2019-0211?

CVE-2019-0211 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 65.0% probability of exploitation.

Which products are affected by CVE-2019-0211?

Affected products include Apache HTTP Server, Netapp Oncommand Unified Manager, Oracle Communications Session Report Manager, Oracle Communications Session Route Manager, Oracle Enterprise Manager Ops Center, and 19 more.

How do I fix CVE-2019-0211?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-0211 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo