CVE-2019-0211 Apache HTTP Server Privilege Escalation
Attackers can escalate privileges to root and execute arbitrary code by manipulating the scoreboard in Apache HTTP Server.
- Exploited in the wild
- Since 3 Nov 2021
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-0211?
CVE-2019-0211 is a high-severity vulnerability in Apache Http Server, published on 8 Apr 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Weakness: CWE-416
Which versions are affected by CVE-2019-0211?
It affects 27 products.
Products include Apache Http Server, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Netapp Oncommand Unified Manager, Opensuse Leap and 21 more.
How do I fix CVE-2019-0211?
Upgrade to a fixed version. US federal agencies must fix it by 3 May 2022.
Is CVE-2019-0211 being exploited?
Yes. Attackers have exploited CVE-2019-0211 in the wild since at least 3 Nov 2021.
Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2019-0211, CLEANSTART-2026-DX30733, DEBIAN-CVE-2019-0211, GHSA-w9rc-q752-88hf, UBUNTU-CVE-2019-0211.