CVE-2011-1176

CVE-2011-1176 is a medium-severity vulnerability in Mpm-itk Project Mpm-itk with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Description

The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.

Frequently asked questions

What is CVE-2011-1176?
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
How severe is CVE-2011-1176?
CVE-2011-1176 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2011-1176 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (84th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2011-1176?
CVE-2011-1176 primarily affects Mpm-itk Project Mpm-itk. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2011-1176?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2011-1176 published?
CVE-2011-1176 was published on 2011-03-29 and last updated on 2026-06-16.

References

Affected products (5)

Threat intelligence

Threat-intel indicators referencing this CVE: