CVE-2019-0217

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 17.43%
EPSS Percentile: 97.11%
CISA KEV: Not listed

Description

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security@apache.org
Published: 09-Apr-2019 04:29
Last Modified: 17-Jun-2026 09:08
EPSS Date: 2026-10-20
CWE: CWE-362

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

apache / http_server
Version / affected range: * · from (inclusive) 2.4.0 · through (inclusive) 2.4.38
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
debian / debian_linux
Version / affected range: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
debian / debian_linux
Version / affected range: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 28
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 29
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
fedoraproject / fedora
Version / affected range: 30
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
canonical / ubuntu_linux
Version / affected range: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
canonical / ubuntu_linux
Version / affected range: 14.04
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
canonical / ubuntu_linux
Version / affected range: 16.04
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
canonical / ubuntu_linux
Version / affected range: 18.04
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
canonical / ubuntu_linux
Version / affected range: 18.10
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
redhat / enterprise_linux
Version / affected range: -
cpe:2.3:o:redhat:enterprise_linux:-:*:*:*:*:*:*:*
redhat / enterprise_linux_desktop
Version / affected range: 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
redhat / enterprise_linux_server
Version / affected range: 7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
redhat / enterprise_linux_workstation
Version / affected range: 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
opensuse / leap
Version / affected range: 15.0
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
opensuse / leap
Version / affected range: 42.3
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
netapp / oncommand_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:*
netapp / clustered_data_ontap
Version / affected range: -
cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
oracle / enterprise_manager_ops_center
Version / affected range: 12.3.3
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*
oracle / enterprise_manager_ops_center
Version / affected range: 12.4.0
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*
oracle / http_server
Version / affected range: 12.2.1.3.0
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*
oracle / retail_xstore_point_of_service
Version / affected range: 7.0
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*
oracle / retail_xstore_point_of_service
Version / affected range: 7.1
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*

References

Last enrichment sync: 21-Oct-2026 19:22
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Web Server / Apache HTTP Server vulnerabilities; 7.40% CVE-2017-9798, *CVE-2019-0217, 7.5 Yes Act Edgescan 2026 Report Highlights High-Risk Application Flaws and Remediation Backlogs

CVE (6)

Malware (5)

People (1)

Threat Actors (1)

Vendors (1)

Products (6)

Industries (2)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.