Description

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Remediation

References

CVE-2005-2700

Related Vulnerabilities

OpenSSL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2015-0292)

WordPress Plugin MF Gig Calendar 'page_id' Parameter Cross-Site Scripting (0.9.4.1)

Joomla! Core SQL Injection (1.7.0 - 3.9.15)

WordPress Plugin multi Scheduler Cross-Site Request Forgery (1.0.0)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3586)

Severity

Critical

Classification

CVE-2005-2700

Tags

Missing Update Known Vulnerabilities