Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-3j3g-3pw9-9vcc

Опубликовано: 05 дек. 2025
Источник: github
Github: Не прошло ревью
CVSS3: 5.4

Описание

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.

This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.

EPSS

Процентиль: 17%
0.00055
Низкий

5.4 Medium

CVSS3

Дефекты

CWE-288

Связанные уязвимости

CVSS3: 5.4
ubuntu
4 месяца назад

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS3: 5.4
redhat
4 месяца назад

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS3: 5.4
nvd
4 месяца назад

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

CVSS3: 5.4
msrc
3 месяца назад

Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo

CVSS3: 5.4
debian
4 месяца назад

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in ...

EPSS

Процентиль: 17%
0.00055
Низкий

5.4 Medium

CVSS3

Дефекты

CWE-288