What’s Vulnerable › Vulnerabilities

CVE-2020-1927

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 56.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-02 · updated 2026-06-17
• Weakness: CWE-601

Description

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

Affected products

• Apache HTTP Server: from 2.4.0 through 2.4.41
• Broadcom Brocade Fabric Operating System: all versions
• Canonical Ubuntu Linux: 16.04, 18.04, 20.04
• Debian Linux: 9.0, 10.0
• Fedoraproject Fedora: 31, 32
• NetApp Oncommand Unified Manager Core Package: all versions
• openSUSE Leap: 15.1
• Oracle Communications Element Manager: 8.1.1, 8.2.0, 8.2.1
• Oracle Communications Session Report Manager: 8.1.1, 8.2.0, 8.2.1
• Oracle Communications Session Route Manager: 8.1.1, 8.2.0, 8.2.1
• Oracle Corporation Enterprise Manager Ops Center: 12.4.0.0
• Oracle Instantis Enterprisetrack: from 17.1 through 17.3
• Oracle Corporation SD-WAN Aware: 8.2
• Oracle Corporation Oracle ZFS Storage Appliance Kit: 8.8

References

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html
• http://www.openwall.com/lists/oss-security/2020/04/03/1
• http://www.openwall.com/lists/oss-security/2020/04/04/1
• https://httpd.apache.org/security/vulnerabilities_24.html
• https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84%40%3Ccvs.httpd.apache.org%3E
• https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7%40%3Ccvs.httpd.apache.org%3E

Get alerted when CVE-2020-1927 or the next vulnerability affects your stack