Description
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
Remediation
References
Related Vulnerabilities
WordPress Plugin Tutor LMS-eLearning and online course solution Multiple Vulnerabilities (1.7.6)
WordPress Plugin Radio Buttons for Taxonomies Cross-Site Request Forgery (2.0.5)
WordPress Plugin Network Publisher 'networkpub_key' Parameter Cross-Site Scripting (5.0.1)
Envoy Proxy Uncontrolled Resource Consumption Vulnerability (CVE-2024-23323)