CVE-2019-0215

A flaw was found in Apache HTTP Server 2.4 (releases 2.4.37 and 2.4.38). A bug in mod_ssl, when using per-location client certificate verification with TLSv1.3, allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions. An attacker could perform various unauthorized actions after bypassing the restrictions. The highest threat from this vulnerability is to data confidentiality and integrity.

This flaw can be exploited for httpd configurations where per-location client certificates are enabled and TLS 1.3 is used.

The attacker can remotely exploit this httpd flaw (AV:N). However the server had to be configured to use per-location client certificate and the attacker needs to have access to the authenticating client certificate (AC:H). No other significant privileges are required by the attacker (PR:L). The result of the attack is bypass of the configured access control restrictions (CI:H). This however does not affect the system beyond the web server itself (S:U).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.