CVE-2019-0220

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.38

Description A vulnerability was found in the Apache HTTP Server. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions, while other aspects of the server's processing will implicitly collapse them. The issue is related to the incorrect handling of requests containing multiple consecutive slashes, which can allow a remote attacker to access confidential data.

Recommendations For Apache HTTP Server versions 2.4.0 through 2.4.38, consider updating the RewriteRule directive to account for duplicate slashes in regular expressions. As a temporary workaround, consider restricting access to sensitive data until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.