mod_cgi in Apache 2.0.39 and 2.0.40 allows local users and possibly remote attackers to cause a denial of service (hang and memory consumption) by causing a CGI script to send a large amount of data to stderr, which results in a read/write deadlock between httpd and the CGI script.

Threat-Mapped Scoring

Score: 1.5

Priority: P4 - Informational (Low)

• S10 – Denial of Service

EPSS

Score: 0.03015
Percentile: 0.86042

CVSS Scoring

Mapped CWE(s)

• CWE-667 : Improper Locking

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1499.004 : Application or System Exploitation
  Kill Chain: impact

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
• cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*

← Back to Home