Vulnerability in Apache Http_server
CVE-2015-3185
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which al…
EPSS: 0.064 (91.2th percentile) — read the EPSS interpretation.
Affected products
- Apache Http_server — versions 2.4.0, 2.4.1, 2.4.2
- Apple Mac_os_x — versions 10.10.4
- Apple Mac_os_x_server — versions 5.0.3
- Apple Xcode — versions 7.0
- Canonical Ubuntu_linux — versions 12.04, 14.04, 15.04
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- openSUSE-SU-2015:1684 (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- RHSA-2015:1667 (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)
- APPLE-SA-2015-09-16-2 (vendor-advisory, x_refsource_APPLE)
- RHSA-2017:2709 (x_refsource_REDHAT, vendor-advisory)
- RHSA-2015:1666 (x_refsource_REDHAT, vendor-advisory)
- 1032967 (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2015-3185?
- CVE-2015-3185 is a vulnerability in Apache Http_server, classified under CWE-264. Published 2015-07-20.
- Is CVE-2015-3185 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.