CVE-2019-0211

HIGH(7.8)KEVLikely Exploited

Apache HTTP Server Privilege Escalation Vulnerability

Description

CVE-2019-0211 is a high-severity privilege escalation vulnerability in Apache HTTP Server versions 2.4.17 through 2.4.38, affecting Unix systems with MPM event, worker, or prefork configurations. Code executing in less-privileged child processes or threads, including scripts executed by in-process scripting interpreters, could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. CISA has added CVE-2019-0211 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. With an EPSS score of 89.1% (99.5th percentile), exploitation probability is very high.

KEV Information

Vendor
Apache
Product
HTTP Server
Date Added
November 3, 2021
Due Date
May 3, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
1.8
Impact Score
5.9

CWEs

CWE-416Use After Free

Use After Free

Affected Products

VendorProductVersion
apachehttp server>= 2.4.17, <= 2.4.38
fedoraprojectfedora28; 29; 30
canonicalubuntu linux14.04; 16.04; 18.04; 18.10
debiandebian linux9.0
opensuseleap15.0; 42.3
netapponcommand unified manager-
redhatjboss core services1.0
redhatopenshift container platform3.11
redhatopenshift container platform for power3.11_ppc64le
redhatsoftware collections1.0
redhatenterprise linux8.0
redhatenterprise linux eus8.1; 8.2; 8.4; 8.6; 8.8
redhatenterprise linux for arm 648.0_aarch64
redhatenterprise linux for arm 64 eus8.1_aarch64; 8.2_aarch64; 8.4_aarch64; 8.6_aarch64; 8.8_aarch64
redhatenterprise linux for ibm z systems8.0_s390x
redhatenterprise linux for ibm z systems eus8.1_s390x; 8.2_s390x; 8.4_s390x; 8.6_s390x; 8.8_s390x
redhatenterprise linux for power little endian8.0_ppc64le
redhatenterprise linux for power little endian eus8.1_ppc64le; 8.2_ppc64le; 8.4_ppc64le; 8.6_ppc64le; 8.8_ppc64le
redhatenterprise linux server aus8.2; 8.4; 8.6
redhatenterprise linux server tus8.2; 8.4; 8.6; 8.8

Multiple CVSS Assessments

Source: [email protected](Primary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
7.8
HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-416: Use After Free

In Apache HTTP Server, the use after free vulnerability exists in the scoreboard handling mechanism used by the MPM (Multi-Processing Module) event, worker, and prefork modes. Less-privileged child processes can manipulate scoreboard entries to trigger a use after free condition in the parent process, allowing arbitrary code execution with the parent's elevated privileges (typically root).

Learn more: CWE-416 — Use After Free

Impact Analysis

CVE-2019-0211 carries a CVSS 3.1 score of 7.8 (HIGH), representing a serious local privilege escalation threat. The attack requires local access and low privileges but has low complexity and needs no user interaction. Successful exploitation provides complete control over confidentiality, integrity, and availability, as the attacker escalates from a web script or low-privileged child process to root-level execution. The EPSS score of 89.1% indicates a very high probability of exploitation activity. This vulnerability is particularly dangerous in shared hosting environments where multiple users run scripts through the same Apache instance — a compromised script can escalate to root and compromise the entire server, affecting all hosted sites and services.

Exploit Maturity

CVE-2019-0211 has extensive exploit maturity with confirmed active exploitation. CISA has listed it in the Known Exploited Vulnerabilities catalog. Public exploit code is available via Packet Storm Security (CARPE-DIEM) and Exploit Database, both providing local privilege escalation exploits for Apache 2.4.x. An additional exploit is available via Slackware httpd Updates. The EPSS score of 89.1% (99.5th percentile) confirms a very high probability of exploitation. The technique known as "CARPE-DIEM" (CVE-2019-0211 Apache Root Privilege Escalation) demonstrates reliable exploitation through scoreboard manipulation.

Remediation

  1. Upgrade Apache HTTP Server immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade to Apache HTTP Server 2.4.39 or later, which addresses the scoreboard manipulation vulnerability.
  2. Verify that all Apache HTTP Server instances running versions 2.4.17 through 2.4.38 have been updated, including those deployed in Fedora (28, 29, 30), Ubuntu (14.04-18.10), Debian 9.0, openSUSE Leap, Red Hat Enterprise Linux 8.x, and OpenShift Container Platform 3.11.
  3. In shared hosting environments, implement additional isolation through containerization or separate Apache instances per tenant to limit the blast radius of potential privilege escalation.
  4. Monitor for suspicious scoreboard manipulation patterns and unexpected root-level process activity associated with Apache worker processes, particularly in shared hosting configurations.
  5. Audit all scripts and applications running within Apache's in-process interpreters (mod_php, mod_perl, mod_python) for signs of compromise that could be leveraged for privilege escalation.

Technical Details

CVE-2019-0211 is a privilege escalation vulnerability in Apache HTTP Server versions 2.4.17 through 2.4.38, affecting Unix systems using MPM event, worker, or prefork modules. The vulnerability involves a use after free condition in the scoreboard handling mechanism that child processes use to communicate status to the parent process. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects local exploitation requiring low privileges with no user interaction. Malicious code executing in a less-privileged child process, such as a PHP script running under mod_php, can manipulate scoreboard entries in a way that triggers a use after free when the parent process reads the scoreboard. Since the parent process runs as root on most Unix systems, successful exploitation grants root-level code execution, completely compromising the host system.

Frequently Asked Questions

Is CVE-2019-0211 being actively exploited?

Yes. CVE-2019-0211 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 89.1% (99.5th percentile) indicates a very high probability of exploitation, and multiple public exploits including the CARPE-DIEM technique are widely available.

What products are affected by CVE-2019-0211?

CVE-2019-0211 affects Apache HTTP Server versions 2.4.17 through 2.4.38 on Unix systems. Additionally affected are Fedora 28-30, Ubuntu 14.04-18.10, Debian 9.0, openSUSE Leap, Red Hat Enterprise Linux 8.x, Red Hat OpenShift Container Platform 3.11, NetApp OnCommand Unified Manager, and various other Linux distributions.

How do I fix CVE-2019-0211?

Upgrade Apache HTTP Server to version 2.4.39 or later. For distribution-specific packages, apply updates from your vendor (Red Hat, Ubuntu, Debian, SUSE). In shared hosting environments, implement additional isolation measures to limit the impact of potential exploitation.

How severe is CVE-2019-0211?

CVE-2019-0211 has a CVSS 3.1 score of 7.8 (HIGH) and an EPSS score of 89.1% (99.5th percentile). The vulnerability enables privilege escalation from a web script to root on Unix systems, making it especially dangerous in shared hosting environments.

CVSS Score

7.8
HIGH(7.8)

EPSS Score

EPSS Score65.00%
EPSS Percentile99.2%

Dates

PublishedApril 8, 2019
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch