« Volver al listado

CVE-2005-2963

Estado: ModificadaAlta (7.5)—

The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

MOD Auth Shadow — MOD Auth Shadow

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2005-2963",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2005-10-13T21:02:00.000",
  "references": [
    {
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789",
      "source": "security@debian.org"
    },
    {
      "url": "http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:200",
      "source": "security@debian.org"
    },
    {
      "url": "http://secunia.com/advisories/17060/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://secunia.com/advisories/17067",
      "source": "security@debian.org"
    },
    {
      "url": "http://secunia.com/advisories/17348",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.debian.org/security/2005/dsa-844",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "http://www.osvdb.org/19863",
      "source": "security@debian.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/15224",
      "source": "security@debian.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22520",
      "source": "security@debian.org"
    },
    {
      "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:200",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/17060/",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/17067",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/17348",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2005/dsa-844",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/19863",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/15224",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22520",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions."
    }
  ],
  "lastModified": "2026-06-16T22:15:59.010",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "749F9325-2253-420A-941C-BD56491E127B"
            },
            {
              "criteria": "cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84593AE8-E873-4C4F-99F0-81037B5BEC79"
            },
            {
              "criteria": "cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43025F27-302F-41E4-9DD3-99AFAF94B758"
            },
            {
              "criteria": "cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D5BE018-681C-47A9-B911-2A9DAD07096B"
            },
            {
              "criteria": "cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBEBF877-4EB6-4E4F-BF8B-A172D2BA3981"
            },
            {
              "criteria": "cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F30540C5-133A-4B84-9F6C-576AD87CF6F3"
            },
            {
              "criteria": "cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58AE41C1-D2C6-406B-89D0-C8B3408A0D53"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}