CVE-2020-1927: 
Apache HTTP Server vulnerability analysis and mitigation

CVE-2020-1927 affects Apache HTTP Server versions 2.4.0 to 2.4.41. The vulnerability involves redirects configured with modrewrite that were intended to be self-referential but could be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL ([Apache Security](https://httpd.apache.org/security/vulnerabilities24.html), Rapid7).

The vulnerability has a CVSS v3.1 base score of 6.1 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates it is network accessible, requires low attack complexity, needs no privileges, requires user interaction, has changed scope, and can impact confidentiality and integrity but not availability (NVD).

A successful exploit could allow an attacker to perform redirects to an unexpected URL, potentially leading to open redirect vulnerabilities. This could be used to conduct phishing attacks by redirecting users to malicious sites (Rapid7).

Users should upgrade to Apache HTTP Server version 2.4.42 or later which contains the fix for this vulnerability. The issue was fixed in Apache HTTP Server 2.4.42 (Ubuntu Security, Apache Security).