CVE-2019-0211

HIGH KEV RANSOMWARE

Apache HTTP Server < 2.4.38 - Use After Free

Title source: rule

Description

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Exploits (4)

nomisec WORKING POC 11 stars
by ozkanbilge · local
https://github.com/ozkanbilge/Apache-Exploit-2019
github WORKING POC 1 stars
by vaishakhcv · perlpoc
https://github.com/vaishakhcv/CVE-exploits/tree/master/CVE-2019-0211
github WORKING POC
by winterwolf32 · perlpoc
https://github.com/winterwolf32/CVE_Exploits-/tree/master/CVE-2019-0211
exploitdb WORKING POC
by cfreal · phplocallinux
https://www.exploit-db.com/exploits/46676

References (52)

... and 32 more

Scores

CVSS v3 7.8
EPSS 0.8945
EPSS Percentile 99.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation Intel

CISA KEV 2021-11-03
VulnCheck KEV 2021-11-03
InTheWild.io 2021-07-23
ENISA EUVD EUVD-2019-1002
Ransomware Use Confirmed

Classification

CWE
CWE-416
Status published

Affected Products (50)

apache/http_server < 2.4.38
fedoraproject/fedora
fedoraproject/fedora
fedoraproject/fedora
canonical/ubuntu_linux
canonical/ubuntu_linux
canonical/ubuntu_linux
canonical/ubuntu_linux
debian/debian_linux
opensuse/leap
opensuse/leap
netapp/oncommand_unified_manager
redhat/jboss_core_services
redhat/openshift_container_platform
redhat/openshift_container_platform_for_power
... and 35 more

Timeline

Published Apr 08, 2019
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026