CVE-2015-3185

medium · 4.3

The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.

4.3

CVSS

16.3%

EPSS (exploit prob.)

97th

EPSS percentile

2015-07-20

Published

AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

CWE-264

Affected products

Vendor	Product	Affected versions
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	14.04
canonical	ubuntu_linux	15.04
apache	http_server	2.4.0
apache	http_server	2.4.1
apache	http_server	2.4.2
apache	http_server	2.4.3
apache	http_server	2.4.4
apache	http_server	2.4.6
apache	http_server	2.4.7
apache	http_server	2.4.8
apache	http_server	2.4.9
apache	http_server	2.4.10
apache	http_server	2.4.12
apache	http_server	2.4.13
apple	xcode	7.0
apple	mac_os_x	10.10.4
apple	mac_os_x_server	5.0.3

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-3185