CVE-2015-3675 — Improper Access Control in Apple MAC OS X

CWE-284 — Improper Access Control4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.3%
top 45.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Apple MAC OS XApple OS X Yosemite V10.10.4 AND Security Update 2015-005Debian Apache2
Timeline
PublishedJul 3
Latest updateMay 17

Description

The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4 does not enable the mod_hfs_apple module, which allows remote attackers to bypass HTTP authentication via a crafted URL.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶NVDapple/mac_os_x10.10.3

Patches

Patch: lists.apple.com ↗Patch: lists.apple.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-m856-x5c7-2wc2: The default configuration of the Apache HTTP Server on Apple OS X before 10↗2022-05-17
▶

📋Vendor Advisories

2
Debian
CVE-2015-3675: apache2 - The default configuration of the Apache HTTP Server on Apple OS X before 10.10.4...↗2015
▶
Apple
CVE-2015-3675: OS X Yosemite v10.10.4 and Security Update 2015-005↗
▶