Access Restriction Bypass Affecting apache2 package, versions <2.4.16-1


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.37% (74th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN10-APACHE2-391113
  • published20 Jul 2015
  • disclosed20 Jul 2015

Introduced: 20 Jul 2015

CVE-2015-3185  (opens in a new tab)
CWE-264  (opens in a new tab)

How to fix?

Upgrade Debian:10 apache2 to version 2.4.16-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache2 package and not the apache2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.

References

CVSS Scores

version 3.1