CVE-2025-23048

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.

Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jul 10, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-230498.4Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.CVE-2025-23058.6A Path traversal vulnerability in the file download functionality was identified. This vulnerability allows unauthenticated users to downloa CVE-2025-230503.1QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero).CVE-2025-230517.2An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. S CVE-2025-230527.2Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this CVE-2025-230536.5A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploi CVE-2025-230546.5A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege ope CVE-2025-230555.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230565.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230575.4A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to cond CVE-2025-230588.1A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote atta CVE-2025-230594.9A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensit