#VU18113 Input validation error


Published: 2019-04-02 | Updated: 2020-01-29

Vulnerability identifier: #VU18113

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-0220

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Apache HTTP Server
Server applications / Web servers

Vendor: Apache Foundation

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to the web server does not merge consecutive slashes in URLs, that can lead to incorrect processing of requests when accessing CGI programs. Such web server behavior may lead to security restrictions bypass.

Mitigation
Install updates from vendor's website and make sure that "MergeSlashes" option in the configuration is not set to "Off".

Vulnerable software versions

Apache HTTP Server: 2.2.0 - 2.4.38


CPE

External links
http://www.apache.org/dist/httpd/CHANGES_2.4


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?


Latest bulletins with this vulnerability