{"api_version":"1","generated_at":"2026-07-23T04:29:48+00:00","cve":"CVE-2005-2963","urls":{"html":"https://cve.report/CVE-2005-2963","api":"https://cve.report/api/cve/CVE-2005-2963.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2005-2963","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-2963"},"summary":{"title":"CVE-2005-2963","description":"The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.","state":"PUBLISHED","assigner":"debian","published_at":"2005-10-13 21:02:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.securityfocus.com/bid/15224","name":"http://www.securityfocus.com/bid/15224","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Apache Mod_Auth_Shadow Authentication Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/17348","name":"http://secunia.com/advisories/17348","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Secunia - Advisories - Mandriva update for apache-mod_auth_shadow","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789","name":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"#323789 - Turns itself on when require group is used - Debian Bug report logs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.debian.org/security/2005/dsa-844","name":"http://www.debian.org/security/2005/dsa-844","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Debian -- Security Information -- DSA-844-1 mod-auth-shadow","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/17067","name":"http://secunia.com/advisories/17067","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Debian update for mod-auth-shadow - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/17060/","name":"http://secunia.com/advisories/17060/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Apache mod_auth_shadow Module \"require group\" Incorrect Authentication - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/22520","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/22520","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/19863","name":"http://www.osvdb.org/19863","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:200","name":"http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:200","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"frontal1.mandriva.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-2963","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-2963","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2005","cve_id":"2963","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mod_auth_shadow","cpe5":"mod_auth_shadow","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"2963","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mod_auth_shadow","cpe5":"mod_auth_shadow","cpe6":"1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"2963","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mod_auth_shadow","cpe5":"mod_auth_shadow","cpe6":"1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"2963","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mod_auth_shadow","cpe5":"mod_auth_shadow","cpe6":"1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"2963","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mod_auth_shadow","cpe5":"mod_auth_shadow","cpe6":"1.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"2963","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mod_auth_shadow","cpe5":"mod_auth_shadow","cpe6":"1.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"2963","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mod_auth_shadow","cpe5":"mod_auth_shadow","cpe6":"2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T22:53:30.042Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"modauthshadow-require-group-bypass-security(22520)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/22520"},{"name":"17348","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17348"},{"name":"19863","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/19863"},{"name":"17060","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17060/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789"},{"name":"DSA-844","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"],"url":"http://www.debian.org/security/2005/dsa-844"},{"name":"MDKSA-2005:200","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:200"},{"name":"15224","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/15224"},{"name":"17067","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17067"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2005-10-05T00:00:00.000Z","descriptions":[{"lang":"en","value":"The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-10T14:57:01.000Z","orgId":"79363d38-fa19-49d1-9214-5f28da3f3ac5","shortName":"debian"},"references":[{"name":"modauthshadow-require-group-bypass-security(22520)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/22520"},{"name":"17348","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17348"},{"name":"19863","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/19863"},{"name":"17060","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17060/"},{"tags":["x_refsource_MISC"],"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789"},{"name":"DSA-844","tags":["vendor-advisory","x_refsource_DEBIAN"],"url":"http://www.debian.org/security/2005/dsa-844"},{"name":"MDKSA-2005:200","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:200"},{"name":"15224","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/15224"},{"name":"17067","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17067"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@debian.org","ID":"CVE-2005-2963","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"modauthshadow-require-group-bypass-security(22520)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/22520"},{"name":"17348","refsource":"SECUNIA","url":"http://secunia.com/advisories/17348"},{"name":"19863","refsource":"OSVDB","url":"http://www.osvdb.org/19863"},{"name":"17060","refsource":"SECUNIA","url":"http://secunia.com/advisories/17060/"},{"name":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789","refsource":"MISC","url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=323789"},{"name":"DSA-844","refsource":"DEBIAN","url":"http://www.debian.org/security/2005/dsa-844"},{"name":"MDKSA-2005:200","refsource":"MANDRIVA","url":"http://frontal1.mandriva.com/security/advisories?name=MDKSA-2005:200"},{"name":"15224","refsource":"BID","url":"http://www.securityfocus.com/bid/15224"},{"name":"17067","refsource":"SECUNIA","url":"http://secunia.com/advisories/17067"}]}}}},"cveMetadata":{"assignerOrgId":"79363d38-fa19-49d1-9214-5f28da3f3ac5","assignerShortName":"debian","cveId":"CVE-2005-2963","datePublished":"2005-10-13T04:00:00.000Z","dateReserved":"2005-09-19T00:00:00.000Z","dateUpdated":"2024-08-07T22:53:30.042Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2005-10-13 21:02:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.0:*:*:*:*:*:*:*","matchCriteriaId":"749F9325-2253-420A-941C-BD56491E127B"},{"vulnerable":true,"criteria":"cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.1:*:*:*:*:*:*:*","matchCriteriaId":"84593AE8-E873-4C4F-99F0-81037B5BEC79"},{"vulnerable":true,"criteria":"cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.2:*:*:*:*:*:*:*","matchCriteriaId":"43025F27-302F-41E4-9DD3-99AFAF94B758"},{"vulnerable":true,"criteria":"cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.3:*:*:*:*:*:*:*","matchCriteriaId":"0D5BE018-681C-47A9-B911-2A9DAD07096B"},{"vulnerable":true,"criteria":"cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.4:*:*:*:*:*:*:*","matchCriteriaId":"BBEBF877-4EB6-4E4F-BF8B-A172D2BA3981"},{"vulnerable":true,"criteria":"cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:1.5:*:*:*:*:*:*:*","matchCriteriaId":"F30540C5-133A-4B84-9F6C-576AD87CF6F3"},{"vulnerable":true,"criteria":"cpe:2.3:a:mod_auth_shadow:mod_auth_shadow:2.0:*:*:*:*:*:*:*","matchCriteriaId":"58AE41C1-D2C6-406B-89D0-C8B3408A0D53"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2005","CveId":"2963","Ordinal":"1","Title":"CVE-2005-2963","CVE":"CVE-2005-2963","Year":"2005"},"notes":[{"CveYear":"2005","CveId":"2963","Ordinal":"1","NoteData":"The mod_auth_shadow module 1.0 through 1.5 and 2.0 for Apache with AuthShadow enabled uses shadow authentication for all locations that use the require group directive, even when other authentication mechanisms are specified, which might allow remote authenticated users to bypass security restrictions.","Type":"Description","Title":"CVE-2005-2963"},{"CveYear":"2005","CveId":"2963","Ordinal":"2","NoteData":"2005-10-13","Type":"Other","Title":"Published"},{"CveYear":"2005","CveId":"2963","Ordinal":"3","NoteData":"2017-07-10","Type":"Other","Title":"Modified"}]}}}