Skip to main content
HIGH CISA KEV

CVE-2019-0211

CVSS v3

7.8

HIGH

EPSS Score

65.0 %

exploit probability, as of 2026-10-19

CISA KEV

Yes

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for httpd.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • CVE-2019-0211 Red Hat Product Security321 products fixed · 3 known affected

    httpd: privilege escalation from modules scripts

    jbcs-httpd24 as a component of Red Hat JBoss Enterprise Web Server 2 · jbcs-httpd24-runtime as a component of Red Hat JBoss Enterprise Web Server 2 · jbcs-httpd24.src as a component of Red Hat JBoss Enterprise Web Server 2

  • RHSA-2019:1543 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update

  • RHSA-2019:1297 Red Hat Product Security51 products fixed

    Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update

  • RHSA-2019:1296 Red Hat Product Security1 product fixed

    Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update

  • RHSA-2019:0980 Red Hat Product Security80 products fixed

    Red Hat Security Advisory: httpd:2.4 security update

  • RHSA-2019:0746 Red Hat Product Security189 products fixed

    Red Hat Security Advisory: httpd24-httpd and httpd24-mod_auth_mellon security update

Full record on NVD

Description

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

CISA Known Exploited Vulnerability

Date Added
2021-11-03
Patch Due Date
2022-05-03
Ransomware Use
Unknown

Technical details

Published
2019-04-08
Exploit-DB
EDB-46676

Frequently asked questions

What is CVE-2019-0211?

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Is CVE-2019-0211 actively exploited?

Yes. CVE-2019-0211 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2022-05-03.

What is the CVSS score for CVE-2019-0211?

CVE-2019-0211 has a CVSS v3 base score of 7.8 (HIGH severity).

Running httpd? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, November 2021Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database