CVE-2016-4979: apache http_server Improper Access Control
Vulnerability summary
CVE-2016-4979 is a high (CVSS 7.5) Improper Access Control vulnerability in apache http_server. EPSS estimates a 18.80% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 06-07-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
18.80%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
0.00 pp
From 18.80% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- http_server2.4.18 | 2.4.19 | 2.4.20
Debian1 product
- apache2< 2.4.23-1
2 vendors · 2 products
References
26 links- www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlX Refsource CONFIRM
- www.apache.org/dist/httpd/CHANGES_2.4X Refsource CONFIRM
- www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.htmlX Refsource CONFIRM
Show all 26 references
- github.com/apache/httpd/commit/2d0e4eff04ea963128a41faaef21f987272e05a2X Refsource CONFIRM
- security.netapp.com/advisory/ntap-20180601-0001/X Refsource CONFIRM
