Apache Lounge Windows
Monthly
Local code execution on Windows hosts running the Apache Lounge distribution of Apache HTTP Server (builds before Apache 2.4.68-260920 Win64) is possible because the build hardcodes the path to openssl.cnf, allowing a local attacker who can write to that path to plant a malicious OpenSSL configuration that the server loads when TLS is initialized. The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified CWE-732, meaning the weakness is an incorrect permission assignment for a critical resource; exploitation requires the attacker to already have local interactive or code-execution access on the host and the hardcoded path to be writable at the attacker's privilege level, with successful exploitation affecting confidentiality, integrity, and availability at high impact. No public exploit identified at time of analysis and no CISA KEV listing applies, and the issue is specific to the third-party Apache Lounge Windows build rather than the upstream Apache Software Foundation source or Linux distributions.
Local privilege escalation affects the third-party Apache Lounge Windows distribution of Apache HTTP Server installed to its default directory at the root of C:\, where the folder inherits write access granted to the 'Authenticated Users' group. Any user with an existing local account on the host can plant or overwrite binaries and DLLs in the install tree, and because the Apache service normally runs as SYSTEM, that plant executes with high privileges. This is a local, authenticated-only escalation - not a remotely reachable defect - and the published CVSS 9.1 network vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) is internally inconsistent with the described flaw, which our assessment scores as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Currently there is no public exploit identified at time of analysis and no confirmed CISA KEV listing, and the issue does not affect the official ASF httpd build, only the Apache Lounge repackaging prior to 2.4.68-260920 Win64.
Local code execution on Windows hosts running the Apache Lounge distribution of Apache HTTP Server (builds before Apache 2.4.68-260920 Win64) is possible because the build hardcodes the path to openssl.cnf, allowing a local attacker who can write to that path to plant a malicious OpenSSL configuration that the server loads when TLS is initialized. The vulnerability is rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and classified CWE-732, meaning the weakness is an incorrect permission assignment for a critical resource; exploitation requires the attacker to already have local interactive or code-execution access on the host and the hardcoded path to be writable at the attacker's privilege level, with successful exploitation affecting confidentiality, integrity, and availability at high impact. No public exploit identified at time of analysis and no CISA KEV listing applies, and the issue is specific to the third-party Apache Lounge Windows build rather than the upstream Apache Software Foundation source or Linux distributions.
Local privilege escalation affects the third-party Apache Lounge Windows distribution of Apache HTTP Server installed to its default directory at the root of C:\, where the folder inherits write access granted to the 'Authenticated Users' group. Any user with an existing local account on the host can plant or overwrite binaries and DLLs in the install tree, and because the Apache service normally runs as SYSTEM, that plant executes with high privileges. This is a local, authenticated-only escalation - not a remotely reachable defect - and the published CVSS 9.1 network vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) is internally inconsistent with the described flaw, which our assessment scores as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Currently there is no public exploit identified at time of analysis and no confirmed CISA KEV listing, and the issue does not affect the official ASF httpd build, only the Apache Lounge repackaging prior to 2.4.68-260920 Win64.