Description

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

Remediation

References

CVE-2005-2700

Related Vulnerabilities

WordPress Plugin Countdown and CountUp, WooCommerce Sales Timer Cross-Site Request Forgery (1.5.7)

WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.29)

ATutor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-6528)

WordPress Plugin Alpine PhotoTile for Instagram Cross-Site Scripting (1.2.7.5)

Plone CMS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-5494)

Severity

Critical

Classification

CVE-2005-2700

Tags

Missing Update Known Vulnerabilities