Vulnerability Details CVE-2013-4566
mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 32.7%
CVSS Severity
CVSS v2 Score 4.0
References
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00118.html
- http://rhn.redhat.com/errata/RHSA-2013-1779.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1016832
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00118.html
- http://rhn.redhat.com/errata/RHSA-2013-1779.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1016832
Products affected by CVE-2013-4566
-
cpe:2.3:a:mod_nss_project:mod_nss:1.0
-
cpe:2.3:a:mod_nss_project:mod_nss:1.0.2
-
cpe:2.3:a:mod_nss_project:mod_nss:1.0.3
-
cpe:2.3:a:mod_nss_project:mod_nss:1.0.4
-
cpe:2.3:a:mod_nss_project:mod_nss:1.0.5
-
cpe:2.3:a:mod_nss_project:mod_nss:1.0.6
-
cpe:2.3:a:mod_nss_project:mod_nss:1.0.7
-
cpe:2.3:a:mod_nss_project:mod_nss:1.0.8
-
cpe:2.3:o:redhat:enterprise_linux:5
-
cpe:2.3:o:redhat:enterprise_linux:6.0