CVE-2014-0242

moderate-risk

Published 2019-12-09

mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.

Do I need to act?

8.6% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

39196

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (1)

Mod Wsgi

Affected Vendors

Modwsgi

References (8)

Release Notes http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html

Release Notes http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html

Mailing List http://www.openwall.com/lists/oss-security/2014/05/21/1

Third Party Advisory http://www.securityfocus.com/bid/67534

Release Notes http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html

Release Notes http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html

Mailing List http://www.openwall.com/lists/oss-security/2014/05/21/1

Third Party Advisory http://www.securityfocus.com/bid/67534

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 17/34 · Moderate

Exposure 5/34 · Minimal