PT-2004-3237 · Apache · Apache Http Server

CVE-2004-2343 · Publicado 2004-12-31 · Atualizado 2024-08-08

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.0.47 and earlier

Description: The issue allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. It is noted that the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.

Recommendations: For Apache HTTP Server versions 2.0.47 and earlier, consider restricting access to the ErrorDocument directive to prevent local users from bypassing .htaccess file restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-2343

Produtos afetados

Apache Http Server

Referências · 7

• http://archives.neohapsis.com/archives/bugtraq/2004-02/0120.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2343 · Nota de Segurança
• https://t.me/cvenotify/89856 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15015 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2004-02/0043.html · Aviso do Fabricante
• http://archives.neohapsis.com/archives/bugtraq/2004-02/0064.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2343 · Nota