CVE-2015-3185

EUVD-2015-3255
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
canonicalubuntu_linux
12.04
canonicalubuntu_linux
14.04
canonicalubuntu_linux
15.04
apachehttp_server
2.4.0
apachehttp_server
2.4.1
apachehttp_server
2.4.2
apachehttp_server
2.4.3
apachehttp_server
2.4.4
apachehttp_server
2.4.6
apachehttp_server
2.4.7
apachehttp_server
2.4.8
apachehttp_server
2.4.9
apachehttp_server
2.4.10
apachehttp_server
2.4.12
apachehttp_server
2.4.13
applexcode
7.0
applemac_os_x
10.10.4
applemac_os_x_server
5.0.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
apache2
bookworm
2.4.62-1~deb12u1
fixed
bookworm (security)
2.4.62-1~deb12u2
fixed
bullseye
2.4.62-1~deb11u1
fixed
bullseye (security)
2.4.62-1~deb11u2
fixed
sid
2.4.62-3
fixed
squeeze
not-affected
trixie
2.4.62-3
fixed
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
apache2
precise
not-affected
trusty
Fixed 2.4.7-1ubuntu4.5
released
utopic
ignored
vivid
Fixed 2.4.10-9ubuntu1.1
released
Common Weakness Enumeration
References