VulnerabilityModified

CVE-2014-0231

The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.

MEDIUM 5.0EPSS 43.8%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 43.8%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS: 43.81% probability · 99th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-399
Affected: apache/http server
Source: secalert@redhat.com

EPSS trend

EPSS 43.8% since 4 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

http://advisories.mageia.org/MGASA-2014-0304.htmlThird Party Advisory
http://advisories.mageia.org/MGASA-2014-0305.htmlThird Party Advisory
http://httpd.apache.org/security/vulnerabilities_24.htmlPatch, Vendor Advisory
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlMailing List
http://marc.info/?l=bugtraq&m=143403519711434&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=143748090628601&w=2Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144050155601375&w=2Mailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=144493176821532&w=2Mailing List, Third Party Advisory
http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2014-1019.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1020.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1021.htmlBroken Link
http://secunia.com/advisories/60536Mitigation, Third Party Advisory
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGESThird Party Advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.cThird Party Advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1482522&r2=1535125&diff_format=hThird Party Advisory
http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/generators/mod_cgid.c?r1=1565711&r2=1610509&diff_format=hThird Party Advisory
http://www.debian.org/security/2014/dsa-2989Third Party Advisory, VDB Entry
http://www.mandriva.com/security/advisories?name=MDVSA-2014:142Broken Link, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlPatch, Third Party Advisory
http://www.securityfocus.com/bid/68742Broken Link, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1120596Issue Tracking
https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246Not Applicable, VDB Entry
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.