{"id":"CVE-2020-13938","aliases":["ALPINE-CVE-2020-13938","BELL-CVE-2020-13938","BIT-apache-2020-13938","EUVD-2020-6130","GHSA-qvx2-v283-5hp3"],"status":"published","title":"Improper Handling of Insufficient Privileges","description":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.11773,"percentile":0.96112,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2021-06-10T07:10:20Z","modified":"2026-10-26T11:17:55Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.48-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apache","fixed_in":["2.4.47"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.48-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apache","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.47"}]}]}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"},{"vendor":"mcafee","product":"epolicy_orchestrator"},{"vendor":"netapp","product":"cloud_backup"}],"references":[{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Release Notes","Vendor Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r5fdc4fbbc7ddb816c843329a9accdcf284ade86e8d77b8c2a6d9bc30%40%3Cannounce.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/06/10/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210702-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10379","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-13938","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r5fdc4fbbc7ddb816c843329a9accdcf284ade86e8d77b8c2a6d9bc30@%3Cannounce.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd@%3Cdev.httpd.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-qvx2-v283-5hp3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-13938","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-13938","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-13938","title":"Improper Handling of Insufficient Privileges","description":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","status":"published","published":"2021-06-10T07:10:20Z","modified":"2024-08-04T12:32:14.566Z","updated_at":"2026-11-02T14:35:54.170199Z"}],"euvd":[{"id":"EUVD-2020-6130","description":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","status":"published","published":"2021-06-10T07:10:20Z","modified":"2024-08-04T12:32:14Z","updated_at":"2026-11-03T03:07:35.697348Z"}],"ghsa":[{"id":"GHSA-qvx2-v283-5hp3","title":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","description":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","status":"published","published":"2022-05-24T19:04:56Z","modified":"2023-01-29T05:06:58Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:46:07.768849Z"}],"nvd":[{"id":"CVE-2020-13938","description":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","status":"published","published":"2021-06-10T07:15:07.403Z","modified":"2026-06-17T02:53:56.45Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:06:43.288951Z"}],"osv":[{"id":"ALPINE-CVE-2020-13938","description":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","status":"published","published":"2021-06-10T07:15:07.403Z","modified":"2026-10-26T11:17:55.114337703Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-13938","title":"CVE-2020-13938 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:43.495975Z","modified":"2026-01-26T09:48:45.922633Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2020-13938","description":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","status":"published","published":"2021-06-10T07:15:07.403Z","modified":"2026-10-24T10:30:29.111487404Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"BIT-apache-2020-13938","title":"Improper Handling of Insufficient Privileges","description":"Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows","status":"published","published":"2024-03-06T10:57:27.697Z","modified":"2026-09-08T08:45:22.394704957Z","updated_at":"2026-11-02T15:28:28.267217Z"}]}}