peter bassill · operator
$ cve CVE-2017-3167 JSON

CVE-2017-3167

9.8
CRITICAL · CVSS 3.1 · EPSS 20.2% (pctl 97)

Patch early

EPSS 20.2% — above the 10% action threshold.

Description

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS20.23% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-287
On CISA KEVno
Public exploitnone known
Published2017-06-20
Last modified2026-06-17

Affected (15)

VendorProduct
apachehttp server
applemac os x
debiandebian linux
netappclustered data ontap
netapponcommand unified manager
netappstoragegrid
oraclesecure global desktop
redhatenterprise linux
redhatenterprise linux desktop
redhatenterprise linux eus
redhatenterprise linux server
redhatenterprise linux server aus
redhatenterprise linux server tus
redhatenterprise linux workstation
redhatjboss core services

References

→ the Explorer  ·  watch your stack  ·  NVD