CVE-2005-0088 Auth bypass in n/a

High 7.5 Published 10 Feb 2005 Updated 7 Aug 2024

Remote attackers can access restricted objects in mod_python via crafted URLs, bypassing intended access controls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2005-0088?

CVE-2005-0088 is a high-severity authentication bypass vulnerability in n/a, published on 10 Feb 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The publisher handler for mod_python 2.7.8 and earlier allows remote attackers to obtain access to restricted objects via a crafted URL.

Which versions are affected by CVE-2005-0088?

It affects 1 product.

Linux distribution packages (16)

`mod_python` Red Hat:enterprise_linux:3::as	All versions	`0:3.0.3-5.ent`
`mod_python-debuginfo` Red Hat:enterprise_linux:3::as	All versions	`0:3.0.3-5.ent`
`mod_python` Red Hat:enterprise_linux:3::desktop	All versions	`0:3.0.3-5.ent`
`mod_python-debuginfo` Red Hat:enterprise_linux:3::desktop	All versions	`0:3.0.3-5.ent`
`mod_python` Red Hat:enterprise_linux:3::es	All versions	`0:3.0.3-5.ent`
`mod_python-debuginfo` Red Hat:enterprise_linux:3::es	All versions	`0:3.0.3-5.ent`
`mod_python` Red Hat:enterprise_linux:3::ws	All versions	`0:3.0.3-5.ent`
`mod_python-debuginfo` Red Hat:enterprise_linux:3::ws	All versions	`0:3.0.3-5.ent`
`mod_python` Red Hat:enterprise_linux:4::as	All versions	`0:3.1.3-5.1`
`mod_python-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:3.1.3-5.1`
`mod_python` Red Hat:enterprise_linux:4::desktop	All versions	`0:3.1.3-5.1`
`mod_python-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:3.1.3-5.1`
`mod_python` Red Hat:enterprise_linux:4::es	All versions	`0:3.1.3-5.1`
`mod_python-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:3.1.3-5.1`
`mod_python` Red Hat:enterprise_linux:4::ws	All versions	`0:3.1.3-5.1`
`mod_python-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:3.1.3-5.1`

Products include Apache Mod Python.

How do I fix CVE-2005-0088?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2005-0088 being exploited?

There is no known exploitation of CVE-2005-0088 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2005-0088, DSA-689-1, GHSA-4xhm-pcpf-389c, RHSA-2005:100, RHSA-2005:104.