Wiz
Vulnerability DatabaseCVE-2020-13938

CVE-2020-13938: 
Apache HTTP Server vulnerability analysis and mitigation

Overview

CVE-2020-13938 affects Apache HTTP Server versions 2.4.0 to 2.4.46 running on Windows systems. The vulnerability allows unprivileged local users to stop the httpd service on Windows platforms (Apache Advisory, OSS Security). The issue was discovered by Ivan Zhakov and was publicly disclosed in June 2021.

Technical details

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. This indicates a local attack vector with low attack complexity, requiring low privileges and no user interaction. The scope is unchanged, with no impact on confidentiality or integrity, but high impact on availability (NVD).

Impact

The primary impact of this vulnerability is on system availability, as it allows unprivileged local users to stop the Apache HTTP Server service on Windows systems. This could result in a denial of service condition, disrupting web services running on the affected server (Apache Advisory).

Mitigation and workarounds

The vulnerability was fixed in Apache HTTP Server version 2.4.48. Users running affected versions (2.4.0 to 2.4.46) on Windows systems should upgrade to version 2.4.48 or later to address this security issue (Apache Advisory).

Community reactions

Multiple vendors and organizations have acknowledged this vulnerability and issued advisories, including NetApp who assessed the vulnerability in their products and provided mitigation guidance (NetApp Advisory).

Additional resources

Source: This report was generated using AI

Related Apache HTTP Server vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-23048CRITICAL9.1
  • Apache HTTP ServerApache HTTP Server
  • httpd:2.4::httpd-tools
NoYesJul 10, 2025
CVE-2025-53020HIGH7.5
  • Apache HTTP ServerApache HTTP Server
  • httpd-devel
NoYesJul 10, 2025
CVE-2025-49630HIGH7.5
  • Apache HTTP ServerApache HTTP Server
  • httpd:2.4:820250926134938:9edba152::httpd-manual
NoYesJul 10, 2025
CVE-2025-49812HIGH7.4
  • Apache HTTP ServerApache HTTP Server
  • httpd:2.4::mod_ldap
NoYesJul 10, 2025
CVE-2025-54090MEDIUM6.3
  • Apache HTTP ServerApache HTTP Server
  • httpd
NoYesJul 23, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo