CVE-2020-1927CWE-601

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…

published April 1, 2020

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.1th percentile for exploit probability.

CVSS
—
EPSS
57%
Percentile
99.1
In the wild
Unconfirmed
What it is

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.56691 · 99.1th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2020-04-01T23:08Z
EPSS history
Timeline
  • 01 APR 23:08Z
    In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and…
    cvelistv5