Open Redirect in Apache Http Server
CVE-2020-1927
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
Vulnerability class: Open Redirect
EPSS: 0.049 (89.8th percentile) — read the EPSS interpretation.
Affected products
- Apache Http Server — versions 2.4.0 to 2.4.41
Weakness classification (CWE)
Public proof-of-concept exploits
References
- [oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect (mailing-list, x_refsource_MLIST)
- [oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect (mailing-list, x_refsource_MLIST)
- [httpd-dev] 20200404 Odd vulnerabilities_24.html output (mailing-list, x_refsource_MLIST)
- [httpd-dev] 20200404 Re: Odd vulnerabilities_24.html output (mailing-list, x_refsource_MLIST)
- [httpd-cvs] 20200411 svn commit: r1876405 - in /httpd/test/framework/trunk/t: conf/core.conf.in security/CVE-2020-1927.t (mailing-list, x_refsource_MLIST)
- [httpd-cvs] 20200412 svn commit: r1876426 - /httpd/test/framework/trunk/t/security/CVE-2020-1927.t (mailing-list, x_refsource_MLIST)
- openSUSE-SU-2020:0597 (vendor-advisory, x_refsource_SUSE)
- www.oracle.com/security-alerts/cpujul2020.html (x_refsource_MISC)
- httpd.apache.org/security/vulnerabilities_24.html (x_refsource_CONFIRM)
- security.netapp.com/advisory/ntap-20200413-0002/ (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2020-1927?
- CVE-2020-1927 is a vulnerability in Apache Http Server, classified under URL Redirection to Untrusted Site (Open Redirect). Published 2020-04-01.
- Is CVE-2020-1927 known to be exploited?
- 17 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.