| Package | Affected versions | Patched versions |
|---|---|---|
| http server | ≥ 2.4.0, ≤ 2.4.38 | |
| enterprise manager ops center | = 12.3.3= 12.4.0 | |
| http server | = 12.2.1.3.0 | |
| retail xstore point of service | = 7.0= 7.1 |
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free