CVE-2005-2700

critical Apache
CVSS v3 Base Score
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS Score
15.1%
Exploitation probability in 30 days
Top 5% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Confidentiality
C
Integrity
C
Availability
C
Published: September 6, 2005 (7554 days ago)
Last Modified: April 16, 2026
Vendor: Apache
Source: NVD

Description

ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.

CWE

NVD-CWE-noinfo

Affected Products

apache http serverdebian debian linuxcanonical ubuntu linux

References

🔗 lists.trustix.org 🔗 marc.info 🔗 marc.info 🔗 marc.info 🔗 people.apache.org