Vulnerabilities > CVE-2004-2343 - Unspecified vulnerability in Apache Http Server

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

apache

NVD

Published: 2004-12-31

Updated: 2024-11-20

Summary

Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument

Vulnerable Configurations

Part	Description	Count
Application	Apache Apache Http Server - Apache Http Server 0.8.11 Apache Http Server 0.8.14 Apache Http Server 1.0 Apache Http Server 1.0.2 Apache Http Server 1.0.3 Apache Http Server 1.0.5 Apache Http Server 1.1 Apache Http Server 1.1.1 Apache Http Server 1.2 Apache Http Server 1.2.0 Apache Http Server 1.2.1 Apache Http Server 1.2.2 Apache Http Server 1.2.4 Apache Http Server 1.2.5 Apache Http Server 1.2.6 Apache Http Server 1.2.9 Apache Http Server 1.3 Apache Http Server 1.3.0 Apache Http Server 1.3.1 Apache Http Server 1.3.1.1 Apache Http Server 1.3.2 Apache Http Server 1.3.3 Apache Http Server 1.3.4 Apache Http Server 1.3.5 Apache Http Server 1.3.6 Apache Http Server 1.3.7 Apache Http Server 1.3.8 Apache Http Server 1.3.9 Apache Http Server 1.3.10 Apache Http Server 1.3.11 Apache Http Server 1.3.12 Apache Http Server 1.3.13 Apache Http Server 1.3.14 Apache Http Server 1.3.15 Apache Http Server 1.3.16 Apache Http Server 1.3.17 Apache Http Server 1.3.18 Apache Http Server 1.3.19 Apache Http Server 1.3.20 Apache Http Server 1.3.22 Apache Http Server 1.3.23 Apache Http Server 1.3.24 Apache Http Server 1.3.25 Apache Http Server 1.3.26 Apache Http Server 1.3.27 Apache Http Server 1.3.28 Apache Http Server 1.3.29 Apache Http Server 1.3.30 Apache Http Server 1.3.31 Apache Http Server 1.3.32 Apache Http Server 1.3.33 Apache Http Server 1.3.34 Apache Http Server 1.3.35 Apache Http Server 1.3.36 Apache Http Server 1.3.37 Apache Http Server 1.3.38 Apache Http Server 1.3.39 Apache Http Server 1.3.41 Apache Http Server 1.3.42 Apache Http Server 1.3.65 Apache Http Server 1.3.68 Apache Http Server 1.4.0 Apache Http Server 1.15.17 Apache Http Server 1.99 Apache Http Server 2.0 Apache Http Server 2.0.0 Apache Http Server 2.0.1 Apache Http Server 2.0.2 Apache Http Server 2.0.3 Apache Http Server 2.0.4 Apache Http Server 2.0.5 Apache Http Server 2.0.6 Apache Http Server 2.0.7 Apache Http Server 2.0.8 Apache Http Server 2.0.9 Apache Http Server 2.0.10 Apache Http Server 2.0.11 Apache Http Server 2.0.12 Apache Http Server 2.0.13 Apache Http Server 2.0.14 Apache Http Server 2.0.15 Apache Http Server 2.0.16 Apache Http Server 2.0.17 Apache Http Server 2.0.18 Apache Http Server 2.0.19 Apache Http Server 2.0.20 Apache Http Server 2.0.21 Apache Http Server 2.0.22 Apache Http Server 2.0.23 Apache Http Server 2.0.24 Apache Http Server 2.0.25 Apache Http Server 2.0.26 Apache Http Server 2.0.27 Apache Http Server 2.0.28 Apache Http Server 2.0.29 Apache Http Server 2.0.30 Apache Http Server 2.0.31 Apache Http Server 2.0.32 Apache Http Server 2.0.33 Apache Http Server 2.0.34 Apache Http Server 2.0.35 Apache Http Server 2.0.36 Apache Http Server 2.0.37 Apache Http Server 2.0.38 Apache Http Server 2.0.39 Apache Http Server 2.0.40 Apache Http Server 2.0.41 Apache Http Server 2.0.42 Apache Http Server 2.0.43 Apache Http Server 2.0.44 Apache Http Server 2.0.45 Apache Http Server 2.0.46 Apache Http Server 2.0.47	118

Statements

contributor	Mark J Cox
lastmodified	2008-07-02
organization	Apache
statement	The .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.

contributor Mark J Cox
lastmodified 2006-08-30
organization Red Hat
statement Red Hat does not consider this to be a security issue.

contributor	Mark J Cox
lastmodified	2006-08-30
organization	Red Hat
statement	Red Hat does not consider this to be a security issue.

Summary

Vulnerable Configurations

Statements

References