CVE-2019-0211

Confirmed PUBLISHED

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or...

Apache · Apache HTTP Server

Exploited in the wild

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

7.8 High

At a Glance

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

apache cisa

CVE Published: Apr 08, 2019
Exploitation Reported: Nov 03, 2021
CVSS: 7.8 High
EPSS: —

Low complexity No user interaction

Affected Versions

Vendor	Product	Version	Status
Apache	Apache HTTP Server	2.4.17 to 2.4.38	Affected

CVE References

USN-3937-1 usn.ubuntu.com · Vendor Advisory https://usn.ubuntu.com/3937-1/
FEDORA-2019-cf7695b470 lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
DSA-4422 debian.org · Vendor Advisory https://www.debian.org/security/2019/dsa-4422
FEDORA-2019-119b14075a lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
RHSA-2019:0746 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2019:0746

Show 46 more references

openSUSE-SU-2019:1190 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051...
openSUSE-SU-2019:1209 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061...
GLSA-201904-20 security.gentoo.org · Vendor Advisory https://security.gentoo.org/glsa/201904-20
openSUSE-SU-2019:1258 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084...
RHSA-2019:0980 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2019:0980
RHBA-2019:0959 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHBA-2019:0959
FEDORA-2019-a4ed7400f4 lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
RHSA-2019:1297 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2019:1297
RHSA-2019:1296 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2019:1296
RHSA-2019:1543 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2019:1543
46676 exploit-db.com · Exploit https://www.exploit-db.com/exploits/46676/
107666 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/107666
[oss-security] 20190401 CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2019/04/02/3
20190403 [SECURITY] [DSA 4422-1] apache2 security update seclists.org · Mailing List https://seclists.org/bugtraq/2019/Apr/5
[httpd-users] 20190406 [users@httpd] CVE-2019-0211/0215/0217 lists.apache.org · Mailing List https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9...
20190407 [slackware-security] httpd (SSA:2019-096-01) seclists.org · Mailing List https://seclists.org/bugtraq/2019/Apr/16
[community-dev] 20190411 CVE-2019-0211 applicable to versions 2.2.x? lists.apache.org · Mailing List https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8...
[community-dev] 20190411 Re: CVE-2019-0211 applicable to versions 2.2.x? lists.apache.org · Mailing List https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6f...
[community-dev] 20190411 RE: CVE-2019-0211 applicable to versions 2.2.x? lists.apache.org · Mailing List https://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff22078452055...
[httpd-cvs] 20190611 svn commit: r1861068 - /httpd/site/trunk/content/security/vulnerabilities-httpd.xml lists.apache.org · Mailing List https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde9...
[oss-security] 20190726 Re: Statistics for distros lists updated for 2019Q2 openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2019/07/26/7
[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org · Mailing List https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd...
[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org · Mailing List https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2...
[announce] 20200131 Apache Software Foundation Security Report: 2019 lists.apache.org · Mailing List https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e...
[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org · Mailing List https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de23380...
[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org · Mailing List https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a35...
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66...
[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5...
[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org · Mailing List https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c...
[httpd-cvs] 20210330 svn commit: r1073139 [12/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af...
[httpd-cvs] 20210330 svn commit: r1888194 [12/13] - /httpd/site/trunk/content/security/json/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66...
[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e81026...
[httpd-cvs] 20210330 svn commit: r1073149 [12/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2...
[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org · Mailing List https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde...
synology.com/security/advisory/Synology_SA_19_14 synology.com · CVE Record https://www.synology.com/security/advisory/Synology_SA_19_14
packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Es... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privil...
httpd.apache.org/security/vulnerabilities_24.html httpd.apache.org · CVE Record https://httpd.apache.org/security/vulnerabilities_24.html
packetstormsecurity.com/files/152415/Slackware-Security-Advisory-htt... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/152415/Slackware-Security-Adviso...
packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-P... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-L...
apache.org/dist/httpd/CHANGES_2.4.39 apache.org · CVE Record http://www.apache.org/dist/httpd/CHANGES_2.4.39
support.f5.com/csp/article/K32957101 support.f5.com · CVE Record https://support.f5.com/csp/article/K32957101
security.netapp.com/advisory/ntap-20190423-0001 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20190423-0001/
oracle.com/technetwork/security-advisory/cpujul2019-507... oracle.com · CVE Record https://www.oracle.com/technetwork/security-advisory/cpujul2019-50728...
support.hpe.com/hpsc/doc/public/display support.hpe.com · CVE Record https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId...
oracle.com/technetwork/security-advisory/cpuoct2019-507... oracle.com · CVE Record https://www.oracle.com/technetwork/security-advisory/cpuoct2019-50728...
oracle.com/security-alerts/cpuapr2020.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuapr2020.html

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2019-0211

{
  "cve_id": "CVE-2019-0211",
  "title": "In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker o...",
  "affected_vendor": "Apache",
  "affected_product": "Apache HTTP Server",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 7.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2019-0211

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Timeline

Automate This Intelligence with the Pro API