1. CVE-Search
  2. CVE-2004-2343
ID CVE-2004-2343
Summary Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument
References
Vulnerable Configurations
  • cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:0.8.11:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:0.8.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:0.8.14:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:0.8.14:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.7:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.8:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.10:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.10:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.12:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.13:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.13:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.14:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.15:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.15:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.16:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.16:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.17:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.18:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.19:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.20:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.22:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.23:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.24:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.25:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.26:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.27:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.28:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.29:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.30:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.30:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.31:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.31:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.32:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.32:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.33:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.33:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.34:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.34:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.35:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.35:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.36:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.36:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.37:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.37:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.38:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.38:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.39:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.39:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.41:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.41:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.42:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.42:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.65:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.65:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.3.68:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.3.68:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.15.17:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.15.17:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:1.99:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:1.99:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0:alpha9:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0:alpha9:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.7:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.7:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.8:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.8:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.10:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.10:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.11:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.11:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.12:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.12:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.13:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.14:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.14:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.15:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.15:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.16:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.16:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.17:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.17:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.18:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.18:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.19:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.19:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.20:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.20:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.21:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.21:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.22:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.22:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.23:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.23:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.24:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.24:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.25:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.25:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.26:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.26:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.27:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.27:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.29:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.29:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.30:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.30:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.31:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.31:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.33:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.33:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.34:-:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.34:-:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*
  • cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*
    cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*
CVSS
Base: 7.2 (as of 08-08-2024 - 02:15)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:L/AC:L/Au:N/C:C/I:C/A:C
refmap via4
bugtraq
  • 20040131 BUG IN APACHE HTTPD SERVER (current version 2.0.47)
  • 20040202 Re: BUG IN APACHE HTTPD SERVER (current version 2.0.47)
  • 20040204 Re: BUG IN APACHE HTTPD SERVER (current version 2.0.47)
xf apache-httpd-bypass-restriction(15015)
statements via4
  • contributor Mark J Cox
    lastmodified 2008-07-02
    organization Apache
    statement The .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.
  • contributor Mark J Cox
    lastmodified 2006-08-30
    organization Red Hat
    statement Red Hat does not consider this to be a security issue.
Last major update 08-08-2024 - 02:15
Published 31-12-2004 - 05:00
Last modified 08-08-2024 - 02:15
Back to Top