CVE-2020-1927: 
Apache HTTP Server vulnerability analysis and mitigation

CVE-2020-1927 affects Apache HTTP Server versions 2.4.0 to 2.4.41. The vulnerability involves redirects configured with mod_rewrite that were intended to be self-referential but could be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL (Apache Security, Rapid7).

The vulnerability has a CVSS v3.1 base score of 6.1 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates it is network accessible, requires low attack complexity, needs no privileges, requires user interaction, has changed scope, and can impact confidentiality and integrity but not availability (NVD).

A successful exploit could allow an attacker to perform redirects to an unexpected URL, potentially leading to open redirect vulnerabilities. This could be used to conduct phishing attacks by redirecting users to malicious sites (Rapid7).

The vulnerability requires user interaction and can be exploited remotely without authentication. The attacker needs to craft special requests with encoded newlines to fool the mod_rewrite redirects (Apache Security).

Users should upgrade to Apache HTTP Server version 2.4.42 or later which contains the fix for this vulnerability. The issue was fixed in Apache HTTP Server 2.4.42 (Ubuntu Security, Apache Security).