Vulnerabilities

TI-2020-09645 CVE-2020-11985 · GHSA-39vm-h38v-j867

Insufficient verification of data authenticity in Apache HTTP Server

LOW 34

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.07082 Published 2020-08-07 Partial fix CWE-345

TI-2020-09652 CVE-2020-11993 · GHSA-89mq-r3q6-9q3q

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2…

HIGH 66

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.566 Published 2020-08-07 Partial fix CWE-444

TI-2020-09644 CVE-2020-11984 · GHSA-7fcg-7xhc-3997

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

CRITICAL 85

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.90039 Published 2020-08-07 Partial fix CWE-120

TI-2020-07599 CVE-2020-9490 · GHSA-f2jx-wr3j-25w5

Apache HTTP Server versions 2.4.20 to 2.4.43.

HIGH 75

Apache HTTP Server versions 2.4.20 to 2.4.43.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.88844 Published 2020-08-07 Partial fix CWE-444

Vulnerabilities

Filters

Insufficient verification of data authenticity in Apache HTTP Server

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2…

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

Apache HTTP Server versions 2.4.20 to 2.4.43.