Rapid7 Vulnerability & Exploit Database

Apache HTTPD: ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167)

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

Apache HTTPD: ap_get_basic_auth_pw() Authentication Bypass (CVE-2017-3167)

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
06/20/2017
Created
07/25/2018
Added
06/20/2017
Modified
01/13/2022

Description

Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Third-party module writers SHOULD use ap_get_basic_auth_components(), available in 2.2.34 and 2.4.26, instead of ap_get_basic_auth_pw(). Modules which call the legacy ap_get_basic_auth_pw() during the authentication phase MUST either immediately authenticate the user after the call, or else stop the request immediately with an error response, to avoid incorrectly authenticating the current request.

Solution(s)

  • apache-httpd-upgrade-2_2_34
  • apache-httpd-upgrade-2_4_26

References

View more

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;