Strix
26.1K

CVE-2020-1927

MEDIUMCVSS 6.1/10EPSS 56.69%

Last modified

CVE-2020-1927 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.. EPSS estimates a 56.69% chance of exploitation in the next 30 days.

Description

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

Metrics

CVSS 3.1
6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
56.69%

98.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
ApacheHttp Server>= 2.4.0, <= 2.4.41
FedoraprojectFedora31
FedoraprojectFedora32
DebianDebian Linux9.0
DebianDebian Linux10.0
CanonicalUbuntu Linux16.04
CanonicalUbuntu Linux18.04
CanonicalUbuntu Linux20.04
OpensuseLeap15.1
NetappOncommand Unified Manager Core PackageAll versions
BroadcomBrocade Fabric Operating SystemAll versions
OracleCommunications Element Manager8.1.1
OracleCommunications Element Manager8.2.0
OracleCommunications Element Manager8.2.1
OracleCommunications Session Report Manager8.1.1
OracleCommunications Session Report Manager8.2.0
OracleCommunications Session Report Manager8.2.1
OracleCommunications Session Route Manager8.1.1
OracleCommunications Session Route Manager8.2.0
OracleCommunications Session Route Manager8.2.1
OracleEnterprise Manager Ops Center12.4.0.0
OracleInstantis Enterprisetrack>= 17.1, <= 17.3
OracleSd-Wan Aware8.2
OracleZfs Storage Appliance Kit8.8

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-1927?
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
How severe is CVE-2020-1927?
CVE-2020-1927 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 56.69% probability of exploitation in the next 30 days.
How do I fix CVE-2020-1927?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-1927?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST