Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:LSummary
CVE-2025-66200 is a medium-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Apache Http Server. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-7 (Least Functionality) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-201403
Vulnerability Data
mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through…
more
2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Bypass of suexec/mod_userdir via .htaccess allows CGI execution under unexpected UID, directly enabling local privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the flaw by requiring upgrade from vulnerable 2.4.7-2.4.65 releases to the fixed 2.4.66 version.
Restricts AllowOverride FileInfo and RequestHeader usage in .htaccess to prevent the mod_userdir+suexec bypass.
Enforces least-privilege execution contexts so CGI scripts cannot be forced to run under an unexpected userid.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Requiring authentication on every channel and path directly eliminates alternate-path bypasses.
Enforcing authorizations and least privilege across all access vectors prevents unauthenticated alternate paths.
Protecting networks and environments from unauthorized logical access blocks bypass via undocumented channels.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect alternate-path bypasses but does not prevent them in production.
Secure authentication control directly mitigates bypass by requiring strong, consistent authentication on all paths.
Access control policy directly addresses alternate authentication paths by requiring all channels to enforce authentication.
Authentication information management ensures credentials and mechanisms are consistently applied across all access paths.
Access rights provisioning and review prevent bypass via unmonitored or alternate channels.
Privileged access rights control reduces risk of bypass through elevated or alternate paths.