Every CVE Search/ Get API key

CVE-2020-11985

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using...

5.3 MediumFix available

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

7.08%Down 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Record
CVE-2020-11985
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-345
Updated
2026-11-02
CVE List No score

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Record
CVE-2020-11985
Weakness
CWE-345
Updated
2026-11-02
EUVDEUVD-2020-4308 No score

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Record
EUVD-2020-4308
Updated
2026-11-03
GitHub AdvisoriesGHSA-39vm-h38v-j867 No score

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using...

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Record
GHSA-39vm-h38v-j867
Weakness
CWE-345
Updated
2026-11-02
OSV 5.3

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Record
CVE-2020-11985
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-11985 5.3

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Record
DEBIAN-CVE-2020-11985
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVRHBA-2015:2194 5.3

Red Hat Bug Fix Advisory: httpd bug fix and enhancement update

Record
RHBA-2015:2194
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVRHSA-2017:1161 7.5

Red Hat Security Advisory: httpd24-httpd security, bug fix, and enhancement update

Record
RHSA-2017:1161
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-11985 5.3

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Record
UBUNTU-CVE-2020-11985
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVBIT-apache-2020-11985 No score

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Record
BIT-apache-2020-11985
Updated
2026-11-02
OSVSUSE-SU-2020:2450-1 No score

Security update for apache2

This update for apache2 fixes the following issues:

  • CVE-2020-9490: Fixed a crash caused by a specially crafted value for the 'Cache-Digest' header in a HTTP/2 request (bsc#1175071).
  • CVE-2020-11985: IP address spoofing when proxying using mod_remoteip and mod_rewrite (bsc#1175072).
  • CVE-2020-11993: When trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection (bsc#1175070).
Record
SUSE-SU-2020:2450-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache
Bitnami
 2.4.1 up to 2.4.24
2.4.24
apache2
Debian:12
 before 2.4.25-1
2.4.25-1
apache2
Debian:13
 before 2.4.25-1
2.4.25-1
apache2
Debian:14
 before 2.4.25-1
2.4.25-1
httpd
Red Hat:enterprise_linux:7::client
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-devel
Red Hat:enterprise_linux:7::client
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-manual
Red Hat:enterprise_linux:7::client
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-tools
Red Hat:enterprise_linux:7::client
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_ldap
Red Hat:enterprise_linux:7::client
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
Show 68 moreShow less
Affected packages
PackageAffectedFixed
mod_proxy_html
Red Hat:enterprise_linux:7::client
 before 1:2.4.6-40.el7
1:2.4.6-40.el7
mod_session
Red Hat:enterprise_linux:7::client
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_ssl
Red Hat:enterprise_linux:7::client
 before 1:2.4.6-40.el7
1:2.4.6-40.el7
httpd
Red Hat:enterprise_linux:7::computenode
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-manual
Red Hat:enterprise_linux:7::computenode
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-tools
Red Hat:enterprise_linux:7::computenode
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_ldap
Red Hat:enterprise_linux:7::computenode
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_proxy_html
Red Hat:enterprise_linux:7::computenode
 before 1:2.4.6-40.el7
1:2.4.6-40.el7
mod_session
Red Hat:enterprise_linux:7::computenode
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_ssl
Red Hat:enterprise_linux:7::computenode
 before 1:2.4.6-40.el7
1:2.4.6-40.el7
httpd-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_ldap
Red Hat:enterprise_linux:7::server
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_proxy_html
Red Hat:enterprise_linux:7::server
 before 1:2.4.6-40.el7
1:2.4.6-40.el7
mod_session
Red Hat:enterprise_linux:7::server
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd
Red Hat:enterprise_linux:7::server
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-devel
Red Hat:enterprise_linux:7::server
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-manual
Red Hat:enterprise_linux:7::server
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-tools
Red Hat:enterprise_linux:7::server
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_ssl
Red Hat:enterprise_linux:7::server
 before 1:2.4.6-40.el7
1:2.4.6-40.el7
httpd-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_ldap
Red Hat:enterprise_linux:7::workstation
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_proxy_html
Red Hat:enterprise_linux:7::workstation
 before 1:2.4.6-40.el7
1:2.4.6-40.el7
mod_session
Red Hat:enterprise_linux:7::workstation
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd
Red Hat:enterprise_linux:7::workstation
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-manual
Red Hat:enterprise_linux:7::workstation
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
httpd-tools
Red Hat:enterprise_linux:7::workstation
 before 0:2.4.6-40.el7
0:2.4.6-40.el7
mod_ssl
Red Hat:enterprise_linux:7::workstation
 before 1:2.4.6-40.el7
1:2.4.6-40.el7
httpd24-httpd
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-httpd-devel
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-httpd-manual
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-httpd-tools
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-mod_ldap
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 1:2.4.25-9.el6
1:2.4.25-9.el6
httpd24-mod_session
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el6
0:2.4.25-9.el6
httpd24-mod_ssl
Red Hat:rhel_software_collections:2::el6
From an advisory covering 6 CVEs
 before 1:2.4.25-9.el6
1:2.4.25-9.el6
httpd24-httpd
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-httpd-debuginfo
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-httpd-devel
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-httpd-manual
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-httpd-tools
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-mod_ldap
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-mod_proxy_html
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 1:2.4.25-9.el7
1:2.4.25-9.el7
httpd24-mod_session
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 0:2.4.25-9.el7
0:2.4.25-9.el7
httpd24-mod_ssl
Red Hat:rhel_software_collections:2::el7
From an advisory covering 6 CVEs
 before 1:2.4.25-9.el7
1:2.4.25-9.el7
apache2
SUSE:HPE Helion OpenStack 8
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:OpenStack Cloud 7
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:OpenStack Cloud 8
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:OpenStack Cloud 9
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
SUSE:Enterprise Storage 5
From an advisory covering 3 CVEs
 before 2.4.23-29.63.1
2.4.23-29.63.1
apache2
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.4.6-2ubuntu22.4.6-2ubuntu32.4.6-2ubuntu42.4.7-1ubuntu12.4.7-1ubuntu2
Show 35 moreShow less
2.4.7-1ubuntu32.4.7-1ubuntu42.4.7-1ubuntu4.12.4.7-1ubuntu4.42.4.7-1ubuntu4.52.4.7-1ubuntu4.62.4.7-1ubuntu4.72.4.7-1ubuntu4.82.4.7-1ubuntu4.92.4.7-1ubuntu4.102.4.7-1ubuntu4.112.4.7-1ubuntu4.132.4.7-1ubuntu4.152.4.7-1ubuntu4.162.4.7-1ubuntu4.172.4.7-1ubuntu4.182.4.7-1ubuntu4.192.4.7-1ubuntu4.202.4.7-1ubuntu4.212.4.7-1ubuntu4.222.4.7-1ubuntu4.22+esm12.4.7-1ubuntu4.22+esm22.4.7-1ubuntu4.22+esm32.4.7-1ubuntu4.22+esm42.4.7-1ubuntu4.22+esm52.4.7-1ubuntu4.22+esm62.4.7-1ubuntu4.22+esm82.4.7-1ubuntu4.22+esm92.4.7-1ubuntu4.22+esm102.4.7-1ubuntu4.22+esm122.4.7-1ubuntu4.22+esm132.4.7-1ubuntu4.22+esm142.4.7-1ubuntu4.22+esm152.4.7-1ubuntu4.22+esm162.4.7-1ubuntu4.22+esm17
 None known
apache2
Ubuntu:16.04:LTS
 before 2.4.18-2ubuntu3.15, plus listed versions
2.4.12-2ubuntu22.4.17-1ubuntu12.4.17-2ubuntu12.4.17-3ubuntu12.4.18-1ubuntu1
Show 15 moreShow less
2.4.18-2ubuntu12.4.18-2ubuntu22.4.18-2ubuntu32.4.18-2ubuntu3.12.4.18-2ubuntu3.22.4.18-2ubuntu3.32.4.18-2ubuntu3.42.4.18-2ubuntu3.52.4.18-2ubuntu3.72.4.18-2ubuntu3.82.4.18-2ubuntu3.92.4.18-2ubuntu3.102.4.18-2ubuntu3.122.4.18-2ubuntu3.132.4.18-2ubuntu3.14
2.4.18-2ubuntu3.15

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-11985 is a medium vulnerability (CVSS 5.3) in Apache Http Server, published August 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.08%, the 94th percentile. Fixed in apache 2.4.24.

References

Show 99 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open