Staging Environment: Content and features may be unstable or change without notice.
Advisory details: apache_httpd / CVE-2019-0211
Advisory ID apache_httpd/CVE-2019-0211
Aliases
Summary In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Status Published
Exploitability 2.0
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
apache_httpd important
Reference id Reference type URL
CVE-2019-0211 https://httpd.apache.org/security/json/CVE-2019-0211.json
Data source Exploit-DB
Date added April 8, 2019
Description Apache 2.4.17 < 2.4.38 - 'apache2ctl graceful' 'logrotate' Local Privilege Escalation
Ransomware campaign use Unknown
Source publication date April 8, 2019
Exploit type local
Platform linux
Source update date April 8, 2019
Source URL https://github.com/cfreal/exploits/blob/ba026fae59974037d744a90cef09224f751bc3e4/CVE-2019-0211-apache/cfreal-carpediem.php
Data source KEV
Date added Nov. 3, 2021
Description Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
Required action Apply updates per vendor instructions.
Due date May 3, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2019-0211
Ransomware campaign use Unknown

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-06T21:03:33Z/

Decision: Attend

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2019/0xxx/CVE-2019-0211.json

Source Advisory: vulnrichment/CVE-2019-0211

View SSVC decision tree 
[{'Exploitation': 'active'},
 {'Automatable': 'no'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]