Vulnerability · Published Aug 7, 2020 · Assigned by apache
CVE-2020-11985
Medium 5.3
In plain English
A medium-severity insufficient verification of data authenticity in Apache HTTP Server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.1% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)7.1%top 5.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | apache2 | 2.4.25-1 | DEBIAN-CVE-2020-11985 |
| Debian:13 | apache2 | 2.4.25-1 | DEBIAN-CVE-2020-11985 |
| Debian:14 | apache2 | 2.4.25-1 | DEBIAN-CVE-2020-11985 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache HTTP Server | 2.4.1 to 2.4.23 |
Weakness: CWE-345
References
- https://httpd.apache.org/security/vulnerabilities_24.html x_refsource_MISC
- GLSA-202008-04 vendor-advisory, x_refsource_GENTOO
- FEDORA-2020-189a1e6c3e vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-0d3d3f5072 vendor-advisory, x_refsource_FEDORA
- https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200827-0002/ x_refsource_CONFIRM
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073139 [12/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST