CVE-2020-25073: Debian Freedombox

Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days.

FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection from the Tor onion service (or from PageKite) is considered a local connection. This affects both the freedombox and plinth packages of some Linux distributions, but only if the Apache mod_status module is enabled.

Affected products

• Debian Freedombox: up to and including 20.13

Published 2020-09-02. Last modified 2026-06-17.