Apache HTTP Server Privilege Escalation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| http server | ≥ 2.4.17, ≤ 2.4.38 | |
| communications session report manager | = 8.0.0= 8.1.0= 8.1.1= 8.2.0 | |
| communications session route manager | = 8.0.0= 8.1.0= 8.1.1= 8.2.0 | |
| enterprise manager ops center | = 12.3.3= 12.4.0 | |
| http server | = 12.2.1.3.0 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| retail xstore point of service | = 7.0= 7.1 | |
| jboss core services | = 1.0 | |
| openshift container platform | = 3.11 | |
| openshift container platform for power | = 3.11_ppc64le | |
| software collections | = 1.0 |
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free