CVE-2019-0217

—

CVSS 3.1

7.5 high

EPSS

17%p97

Published

Apr 8, 2019 (Apr 8, 2019)

Modified

Jun 17, 2026

Description

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

Vendors: apache debian fedoraproject canonical redhat opensuse netapp oracle
Products: http server, debian linux, fedora, ubuntu linux, enterprise linux, enterprise linux desktop, enterprise linux server, enterprise linux workstation, leap, oncommand unified manager, clustered data ontap, enterprise manager ops center
Weakness: CWE-362
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (17.4%)

In the news2 stories

New Apache Web Server Bug Threatens Security of Shared Web Hosts

The Hacker NewsApr 3, 09:07 UTC · Apr 3, 2019Exploit / PoC CVE-2019-0211 CVE-2019-0217 CVE-2019-0215

CVE-2019-0211 Apache flaw allows getting root access via script

Security AffairsApr 4, 22:03 UTC · Apr 4, 2019Vulnerability CVE-2019-0211 CVE-2019-0217 CVE-2019-0215