What’s Vulnerable › Vulnerabilities

CVE-2020-11984

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 90.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-08-07 · updated 2026-06-17
• Weakness: CWE-120

Description

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

Affected products

• Apache HTTP Server: from 2.4.32 through 2.4.43
• Canonical Ubuntu Linux: 16.04, 18.04, 20.04
• Debian Linux: 9.0, 10.0
• Fedoraproject Fedora: 31, 32
• Clustered Data ONTAP: all versions
• openSUSE Leap: 15.1, 15.2
• Oracle Communications Element Manager: from 8.2.0 through 8.2.2
• Oracle Communications Session Report Manager: from 8.2.0 through 8.2.2
• Oracle Communications Session Route Manager: from 8.2.0 through 8.2.2
• Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
• Oracle Corporation Oracle Hyperion Infrastructure Technology: 11.1.2.4
• Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
• Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8

References

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.html
• http://packetstormsecurity.com/files/159009/Apache2-mod_proxy_uwsgi-Incorrect-Request-Handling.html
• http://www.openwall.com/lists/oss-security/2020/08/08/1
• http://www.openwall.com/lists/oss-security/2020/08/08/10
• http://www.openwall.com/lists/oss-security/2020/08/08/8
• http://www.openwall.com/lists/oss-security/2020/08/08/9
• http://www.openwall.com/lists/oss-security/2020/08/10/5
• http://www.openwall.com/lists/oss-security/2020/08/17/2
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2020-11984 or the next vulnerability affects your stack