CVE-2017-3167

Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.2.x through 2.2.32 Apache httpd versions 2.4.x through 2.4.25

Description The issue is related to the use of the ap get basic auth pw() function by third-party modules outside of the authentication phase, which may lead to authentication requirements being bypassed. This is due to shortcomings in the authentication procedure. An attacker could exploit this to bypass authentication requirements using external third-party modules.

Recommendations For Apache httpd versions 2.2.x through 2.2.32, update to version 2.2.33 or later. For Apache httpd versions 2.4.x through 2.4.25, update to version 2.4.26 or later.