PT-2021-9681 · Apache · Apache Http Server

Ivan Zhakov · CVE-2020-13938 · Published 2021-06-01 · Updated 2024-03-06

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.46

Description The issue allows unprivileged local users to stop the httpd service on Windows. This was discovered by Ivan Zhakov.

Recommendations For Apache HTTP Server versions 2.4.0 through 2.4.46, consider restricting access to the service to prevent unauthorized stoppage until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-APACHE-2020-13938

CVE-2020-13938

Affected Products

Apache Http Server

References · 15

• http://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13938 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-apache-2020-13938 · Vendor Advisory
• https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-13938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13938 · Security Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10379 · Note
• http://openwall.com/lists/oss-security/2021/06/10/3 · Note
• https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E · Note
• https://t.me/cvenotify/16053 · Telegram Post
• https://t.me/cvenotify/16070 · Telegram Post
• https://security.netapp.com/advisory/ntap-20210702-0001 · Note
• https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-13938 · Note
• https://lists.apache.org/thread.html/r5fdc4fbbc7ddb816c843329a9accdcf284ade86e8d77b8c2a6d9bc30%40%3Cannounce.httpd.apache.org%3E · Note
• https://security.alpinelinux.org/vuln/CVE-2020-13938 · Note