In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-apache2 | Sep 20, 2017 | Jun 20, 2017 | |
| Amazon_linux | — | amazon-linux-upgrade-httpdamazon-linux-upgrade-httpd24 | Aug 4, 2017 | Jun 20, 2017 |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Jun 20, 2017 | Jun 20, 2017 |
| Apple Osx Apache | apple-osx-security-update-2017-001-sierraapple-osx-security-update-2017-004-el-capitan | Nov 1, 2017 | Jun 19, 2017 | |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 20, 2017 |
| Centos_linux | — | centos-upgrade-httpdcentos-upgrade-httpd-debuginfocentos-upgrade-httpd-develcentos-upgrade-httpd-manualcentos-upgrade-httpd-toolscentos-upgrade-mod_ldapcentos-upgrade-mod_proxy_htmlcentos-upgrade-mod_sessioncentos-upgrade-mod_ssl | Aug 16, 2017 | Jun 20, 2017 |
| Debian | debian-upgrade-apache2 | Jun 23, 2017 | Jun 20, 2017 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jun 17, 2026 | Jul 13, 2017 | |
| Freebsd | freebsd-upgrade-package-apache22freebsd-upgrade-package-apache24 | Jun 21, 2017 | Jun 20, 2017 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-apache | Oct 30, 2017 | Jun 19, 2017 | |
| Hpux | — | hpux-update-hpuxwsapache | Mar 28, 2022 | Jun 20, 2017 |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-httpdhuawei-euleros-2_0_sp1-upgrade-httpd-develhuawei-euleros-2_0_sp1-upgrade-httpd-manualhuawei-euleros-2_0_sp1-upgrade-httpd-tools | Jan 18, 2018 | Jun 19, 2017 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-httpdhuawei-euleros-2_0_sp2-upgrade-httpd-develhuawei-euleros-2_0_sp2-upgrade-httpd-manualhuawei-euleros-2_0_sp2-upgrade-httpd-tools | Jan 18, 2018 | Jun 19, 2017 | |
| Ibm Http_server | ibm-http_server-apply-fix-pack-8_0_0_14ibm-http_server-apply-fix-pack-8_5_5_12ibm-http_server-apply-fix-pack-9_0_0_5ibm-http_server-apply-interim-fix-pi82260-for-8_0ibm-http_server-apply-interim-fix-pi82260-for-8_5ibm-http_server-apply-interim-fix-pi82260-for-9_0 | Jun 22, 2018 | Jun 19, 2017 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-server-apache-22-2-2-34-0-175-3-23-0-4-0oracle-solaris-11-3-upgrade-web-server-apache-22-documentation-2-2-34-0-175-3-23-0-4-0oracle-solaris-11-3-upgrade-web-server-apache-22-module-apache-sed-2-2-34-0-175-3-23-0-4-0oracle-solaris-11-3-upgrade-web-server-apache-24-2-4-27-0-175-3-24-0-1-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-dbd-2-4-27-0-175-3-24-0-1-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ldap-2-4-27-0-175-3-24-0-1-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-lua-2-4-27-0-175-3-24-0-1-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-2-4-27-0-175-3-24-0-1-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-27-0-175-3-24-0-1-0 | Aug 21, 2017 | Jun 19, 2017 | |
| Oracle_linux | — | oracle-linux-upgrade-httpdoracle-linux-upgrade-httpd-develoracle-linux-upgrade-httpd-manualoracle-linux-upgrade-httpd-toolsoracle-linux-upgrade-mod-ldaporacle-linux-upgrade-mod-proxy-htmloracle-linux-upgrade-mod-sessionoracle-linux-upgrade-mod-ssl | Aug 16, 2017 | Jun 20, 2017 |
| Redhat_linux | — | redhat-upgrade-httpdredhat-upgrade-httpd-debuginforedhat-upgrade-httpd-develredhat-upgrade-httpd-manualredhat-upgrade-httpd-toolsredhat-upgrade-mod_ldapredhat-upgrade-mod_proxy_htmlredhat-upgrade-mod_sessionredhat-upgrade-mod_ssl | Aug 15, 2017 | Jun 20, 2017 |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Jun 30, 2017 | Jun 20, 2017 |
| Ubuntu | ubuntu-upgrade-apache2-2-binubuntu-upgrade-apache2-bin | Jun 27, 2017 | Jun 20, 2017 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jun 20, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub