CVE-2017-3167

critical · 9.8

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

9.8

CVSS

20.2%

EPSS (exploit prob.)

97th

EPSS percentile

2017-06-20

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-287

Affected products

Vendor	Product	Affected versions
apache	http_server	>= 2.2.0, < 2.2.33
apache	http_server	>= 2.4.0, < 2.4.26
netapp	clustered_data_ontap	all versions
netapp	oncommand_unified_manager	all versions
netapp	storagegrid	all versions
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_desktop	7.0
redhat	enterprise_linux_eus	6.7
redhat	enterprise_linux_eus	7.2
redhat	enterprise_linux_eus	7.3
redhat	enterprise_linux_eus	7.4
redhat	enterprise_linux_eus	7.5
redhat	enterprise_linux_eus	7.6
redhat	enterprise_linux_eus	7.7
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server	7.0
redhat	enterprise_linux_server_aus	7.2
redhat	enterprise_linux_server_aus	7.3
redhat	enterprise_linux_server_aus	7.4
redhat	enterprise_linux_server_aus	7.6
redhat	enterprise_linux_server_aus	7.7
redhat	enterprise_linux_server_tus	7.2
redhat	enterprise_linux_server_tus	7.3
redhat	enterprise_linux_server_tus	7.4
redhat	enterprise_linux_server_tus	7.6
redhat	enterprise_linux_server_tus	7.7
redhat	enterprise_linux_workstation	6.0
redhat	enterprise_linux_workstation	7.0
redhat	jboss_core_services	1.0
redhat	enterprise_linux	6.0
redhat	enterprise_linux	7.0
apple	mac_os_x	< 10.13.1
debian	debian_linux	8.0
debian	debian_linux	9.0
oracle	secure_global_desktop	5.3

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-3167