ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not…

Description

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Scores

EPSS (exploitation in 30 days)

30.6% · top 1.8% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 10.0.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (64)

• 16705 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• DSA-807 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• SSRT051043 (opens in a new tab)vendor-advisoryx_refsource_HPx_transferred
• RHSA-2005:608 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 16700 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 17813 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 16743 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 16753 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm (opens in a new tab)x_refsource_CONFIRMx_transferred
• ADV-2005-2659 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 17088 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• TSLSA-2005-0059 (opens in a new tab)vendor-advisoryx_refsource_TRUSTIXx_transferred
• 22523 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• SUSE-SA:2005:051 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• 16748 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• USN-177-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
• http://people.apache.org/~jorton/CAN-2005-2700.diff (opens in a new tab)x_refsource_CONFIRMx_transferred
• 16754 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• MDKSA-2005:161 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
• oval:org.mitre.oval:def:10416 (opens in a new tab)vdb-entrysignaturex_refsource_OVALx_transferred
• RHSA-2005:773 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167195 (opens in a new tab)x_refsource_CONFIRMx_transferred
• SuSE-SA:2006:051 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• RHSA-2005:816 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
• 16789 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 16714 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 16769 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• ADV-2006-4207 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 17288 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 16956 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 19072 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 21848 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 19188 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• ADV-2005-1625 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 16771 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 16746 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• GLSA-200509-12 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
• SUSE-SA:2005:052 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
• DSA-805 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• 14721 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 19073 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• [apache-modssl] 20050902 [ANNOUNCE] mod_ssl 2.8.24-1.3.33 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• VU#744929 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
• OpenPKG-SA-2005.017 (opens in a new tab)vendor-advisoryx_refsource_OPENPKGx_transferred
• 16864 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 17311 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 102197 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• 102198 (opens in a new tab)vendor-advisoryx_refsource_SUNALERTx_transferred
• ADV-2006-0789 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• [httpd-dev] 20190804 Re: svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-dev] 20190806 Re: svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073139 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073149 [5/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2005-2700](https://trackcve.app/badge/CVE-2005-2700.svg)](https://trackcve.app/cve/CVE-2005-2700)

Record last updated 7 Aug 2024, 22:45 UTC.