Every CVE Search/ Get API key

CVE-2019-0215

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location...

7.5 HighFix available

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

10.4%Down 5.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Record
CVE-2019-0215
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Record
CVE-2019-0215
Updated
2026-11-02
EUVDEUVD-2019-1003 No score

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Record
EUVD-2019-1003
Updated
2026-11-03
GitHub AdvisoriesGHSA-xpmg-8256-c52g 7.5

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location...

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Record
GHSA-xpmg-8256-c52g
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALPINE-CVE-2019-0215 7.5

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Record
ALPINE-CVE-2019-0215
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2019-0215 7.5

CVE-2019-0215 does not affect BellSoft software

Record
BELL-CVE-2019-0215
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.5

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Record
CVE-2019-0215
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-0215 7.5

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

Record
DEBIAN-CVE-2019-0215
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:0980 8.8

Red Hat Security Advisory: httpd:2.4 security update

Record
RHSA-2019:0980
CVSS 3.0
8.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2
Alpine:v3.10
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.11
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.12
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.13
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.14
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.15
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.16
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.17
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.18
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.19
 before 2.4.39-r0
2.4.39-r0
Show 34 moreShow less
Affected packages
PackageAffectedFixed
apache2
Alpine:v3.20
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.21
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.22
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.23
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.24
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.6
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.7
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.8
 before 2.4.39-r0
2.4.39-r0
apache2
Alpine:v3.9
 before 2.4.39-r0
2.4.39-r0
apache2
Debian:12
 before 2.4.38-3
2.4.38-3
apache2
Debian:13
 before 2.4.38-3
2.4.38-3
apache2
Debian:14
 before 2.4.38-3
2.4.38-3
apache2
Debian:10
From an advisory covering 6 CVEs
 before 2.4.38-3+deb10u9, plus listed versions
2.4.38-32.4.38-3+deb10u12.4.38-3+deb10u22.4.38-3+deb10u32.4.38-3+deb10u4
Show 4 moreShow less
2.4.38-3+deb10u52.4.38-3+deb10u62.4.38-3+deb10u72.4.38-3+deb10u8
2.4.38-3+deb10u9
httpd
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
httpd-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
httpd-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
httpd-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
httpd-filesystem
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
httpd-manual
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
httpd-tools
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
httpd-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
mod_http2
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.11.3-2.module+el8.0.0+2969+90015743
0:1.11.3-2.module+el8.0.0+2969+90015743
mod_http2-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.11.3-2.module+el8.0.0+2969+90015743
0:1.11.3-2.module+el8.0.0+2969+90015743
mod_http2-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.11.3-2.module+el8.0.0+2969+90015743
0:1.11.3-2.module+el8.0.0+2969+90015743
mod_ldap
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
mod_ldap-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
mod_md
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
mod_md-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
mod_proxy_html
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:2.4.37-11.module+el8.0.0+2969+90015743
1:2.4.37-11.module+el8.0.0+2969+90015743
mod_proxy_html-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:2.4.37-11.module+el8.0.0+2969+90015743
1:2.4.37-11.module+el8.0.0+2969+90015743
mod_session
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
mod_session-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:2.4.37-11.module+el8.0.0+2969+90015743
0:2.4.37-11.module+el8.0.0+2969+90015743
mod_ssl
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:2.4.37-11.module+el8.0.0+2969+90015743
1:2.4.37-11.module+el8.0.0+2969+90015743
mod_ssl-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 1:2.4.37-11.module+el8.0.0+2969+90015743
1:2.4.37-11.module+el8.0.0+2969+90015743

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-0215 is a high vulnerability (CVSS 7.5) in Apache Http Server, published April 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.4%, the 95th percentile. Fixed in apache2 2.4.39-r0.

References

Show 58 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open