CVE-2019-0211

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.17 through 2.4.38

Description The vulnerability is related to insufficient access control in the MPM module of the Apache HTTP Server, allowing an attacker to execute arbitrary code with root privileges by manipulating the scoreboard. This issue affects Unix systems and can be exploited by executing code in less-privileged child processes or threads, including scripts executed by an in-process scripting interpreter. Non-Unix systems are not affected.

Recommendations For Apache HTTP Server versions 2.4.17 through 2.4.38, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the scoreboard to minimize the risk of exploitation. Additionally, restrict the execution of scripts in less-privileged child processes or threads to reduce the attack surface.