CVE-2019-0217

CVSS 3.1: 7.5 high
EPSS: 17%p97
Published: Apr 8, 2019 · Apr 8, 2019
Modified: Jun 17, 2026

Analyze CVE-2019-0217 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

Vendors: apache debian fedoraproject canonical redhat opensuse netapp oracle

Products: http server, debian linux, fedora, ubuntu linux, enterprise linux, enterprise linux desktop, enterprise linux server, enterprise linux workstation, leap, oncommand unified manager, clustered data ontap, enterprise manager ops center

Weakness: CWE-362

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (17.4%)

In the news

2 stories

New Apache Web Server Bug Threatens Security of Shared Web Hosts

The Hacker NewsApr 3, 09:07 UTC · Apr 3, 2019Exploit / PoCCVE-2019-0211 CVE-2019-0217 CVE-2019-02153 · 1 read

CVE-2019-0211 Apache flaw allows getting root access via script

Security AffairsApr 4, 22:03 UTC · Apr 4, 2019VulnerabilityCVE-2019-0211 CVE-2019-0217 CVE-2019-02151 · 1 read