PT-2004-3237 · Apache · Apache Http Server

Published 2004-12-31 · Updated 2024-08-08 · CVE-2004-2343

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.0.47 and earlier

Description: The issue allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. It is noted that the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.

Recommendations: For Apache HTTP Server versions 2.0.47 and earlier, consider restricting access to the ErrorDocument directive to prevent local users from bypassing .htaccess file restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-2343

Affected Products

Apache Http Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-2343 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2004-02/0043.html · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2004-02/0120.html · Note
• https://t.me/cvenotify/89856 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15015 · Note
• http://archives.neohapsis.com/archives/bugtraq/2004-02/0064.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2343 · Note