Lucene search

K
httpdApache Team FoundationHTTPD:5AE0DECCB3632DACD24792909DC01D94
HistoryAug 30, 2005 - 12:00 a.m.

Apache Httpd < 2.0.55 : SSLVerifyClient bypass

2005-08-3000:00:00
Apache Team Foundation
httpd.apache.org
14

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

58.8%

A flaw in the mod_ssl handling of the “SSLVerifyClient” directive. This flaw would occur if a virtual host has been configured using “SSLVerifyClient optional” and further a directive “SSLVerifyClient required” is set for a specific location. For servers configured in this fashion, an attacker may be able to access resources that should otherwise be protected, by not supplying a client certificate when connecting.

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.002 Low

EPSS

Percentile

58.8%