« Volver al listado

CVE-2004-0009

Estado: ModificadaAlta (7.5)—

Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the "one-line DN" of the target user.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache-ssl — Apache-ssl

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2004-0009",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2004-03-03T05:00:00.000",
  "references": [
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/016870.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=107619127531765&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.apache-ssl.org/advisory-20040206.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/3877",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/9590",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15065",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-February/016870.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=107619127531765&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.apache-ssl.org/advisory-20040206.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/3877",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/9590",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15065",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the \"one-line DN\" of the target user."
    },
    {
      "lang": "es",
      "value": "Apache-SSL 1.3.28+1.52 y anteriores, con SSLVerifyClient establecido a 1 ó 3 y SSLFakeBasicAuth activado, pemite a atantes remotos falsificar un certificado de cliente usando autenticación básica con el \"DN de una línea\" del usuario objetivo."
    }
  ],
  "lastModified": "2026-06-16T22:04:46.177",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache-ssl:apache-ssl:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4640173C-EA49-4FF8-95C6-6B771542626C",
              "versionEndIncluding": "1.3.28_1.52"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}