CVE-2004-2343
** DISPUTED ** Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file...
Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument
Exploit likelihood
What each source reports
NVD Score used
Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument
- Record
CVE-2004-2343- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument
- Record
CVE-2004-2343- Updated
- 2026-11-02
EUVDEUVD-2004-2335 No score
Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument
- Record
EUVD-2004-2335- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r2gf-vgv9-wfwv No score
** DISPUTED ** Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file...
** DISPUTED ** Apache HTTP Server 2.0.47 and earlier allows local users to bypass .htaccess file restrictions, as specified in httpd.conf with directives such as Deny From All, by using an ErrorDocument directive. NOTE: the vendor has disputed this issue, since the .htaccess mechanism is only intended to restrict external web access, and a local user already has the privileges to perform the same operations without using ErrorDocument.
- Record
GHSA-r2gf-vgv9-wfwv- Updated
- 2026-11-02
OSVBELL-CVE-2004-2343
CVE-2004-2343 does not affect BellSoft software
- Record
BELL-CVE-2004-2343- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-2343 is a high vulnerability (CVSS 7.2) in Apache Http Server, published December 31, 2004. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 49th percentile.
References
archives.neohapsis.com/archives/bugtraq/2004-02/0064.html
exchange.xforce.ibmcloud.com/vulnerabilities/15015
nvd.nist.gov/vuln/detail/CVE-2004-2343
github.com/advisories/GHSA-r2gf-vgv9-wfwv
docs.bell-sw.com/security/cves/CVE-2004-2343