PT-2004-1876 · Apache · Apache Http Server

Published 2004-09-18 · Updated 2021-06-06 · CVE-2004-0811

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache version 2.0.51

Description A flaw in the merging of the Satisfy directive could allow attackers to obtain access to restricted resources, contrary to the specified authentication configuration. This issue could result in access being granted to resources despite any configured authentication.

Recommendations For Apache version 2.0.51, consider restricting access to sensitive resources until a fix is available, and review authentication configurations to minimize potential impact. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-0811

Affected Products

Apache Http Server

References · 25

• http://trustix.org/errata/2004/0049 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0811 · Security Note
• http://fedoranews.org/updates/FEDORA-2004-313.shtml · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200409-33.xml · Vendor Advisory
• http://apache.org/dist/httpd/patches/apply_to_2.0.51/CAN-2004-0811.patch · Patch
• https://security-tracker.debian.org/tracker/CVE-2004-0811 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2004-0811 · Vendor Advisory
• https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E · Note
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Note