CVE-2013-4566: mod_nss_project mod_nss
Vulnerability summary
CVE-2013-4566 is a medium (CVSS 4.0) vulnerability in mod_nss_project mod_nss. EPSS estimates a 1.95% chance of exploitation in the next 30 days, higher than 80.2% of scored vulnerabilities.
Not severe (CVSS 4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 12-12-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.95%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
Decrease -0.05 pp
From 2.00% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat3 products
- enterprise_linuxEOL5 | 6.0
- mod_nss< 0:1.0.8-8.el5_10 | < 0:1.0.8-19.el6_5
- mod_nss-debuginfo< 0:1.0.8-8.el5_10 | < 0:1.0.8-19.el6_5
Mageia1 product
- apache-mod_nss< 1.0.8-16.4.mga3
Mod_nss_project1 product
- mod_nss≤ 1.0.8 | 1.0 | 1.0.2 | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.6 | 1.0.7
Ubuntu1 product
- libapache2-mod-nssAll versions (No fix recorded)
4 vendors · 6 products
