CVE catalog
CVE-2020-25073
UBUNTU-CVE-2020-25073
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 2.14% · Oct 25, 2026
FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection from the Tor onion service (or from PageKite) is considered a local connection. This affects both the freedombox and plinth packages of some Linux distributions, but only if the Apache mod_status module is enabled.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | plinth | 16.04 | 0.4.4-1 | vulnerable |
| Ubuntu | plinth | 16.04 | 0.6-1 | vulnerable |
| Ubuntu | plinth | 16.04 | 0.7.1-1 | vulnerable |
| Ubuntu | plinth | 16.04 | 0.7.2-1 | vulnerable |
| Ubuntu | plinth | 16.04 | 0.8.1-1 | vulnerable |
| Ubuntu | plinth | 18.04 | 0.14.0+ds-1 | vulnerable |
| Ubuntu | plinth | 18.04 | 0.22.0 | vulnerable |
| Ubuntu | plinth | 18.04 | 0.23.0 | vulnerable |
| Ubuntu | plinth | 18.04 | 0.24.0 | vulnerable |
| Ubuntu | plinth | 20.04 | 19.14 | vulnerable |
| Ubuntu | plinth | 20.04 | 19.19 | vulnerable |
| Ubuntu | plinth | 20.04 | 19.20 | vulnerable |
| Ubuntu | plinth | 20.04 | 19.21 | vulnerable |
| Ubuntu | plinth | 20.04 | 19.22 | vulnerable |
| Ubuntu | plinth | 20.04 | 19.23 | vulnerable |
| Ubuntu | plinth | 20.04 | 19.24 | vulnerable |
| Ubuntu | plinth | 20.04 | 20.0 | vulnerable |
| Ubuntu | plinth | 20.04 | 20.1 | vulnerable |
| Ubuntu | plinth | 20.04 | 20.2 | vulnerable |
| Ubuntu | plinth | 20.04 | 20.2.1 | vulnerable |
| Ubuntu | plinth | 20.04 | 20.3 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: