Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-8109

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Published

2014-12-29T23:59:00.053

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-863
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache http_server 2.4.1 Yes
Application apache http_server 2.4.2 Yes
Application apache http_server 2.4.3 Yes
Application apache http_server 2.4.4 Yes
Application apache http_server 2.4.6 Yes
Application apache http_server 2.4.7 Yes
Application apache http_server 2.4.9 Yes
Application apache http_server 2.4.10 Yes
Operating System canonical ubuntu_linux 10.04 Yes
Operating System canonical ubuntu_linux 12.04 Yes
Operating System canonical ubuntu_linux 14.04 Yes
Operating System canonical ubuntu_linux 14.10 Yes
Operating System fedoraproject fedora 21 Yes
Application oracle enterprise_manager_ops_center < 12.1.4 Yes
Application oracle enterprise_manager_ops_center 12.2.0 Yes
Application oracle enterprise_manager_ops_center 12.2.1 Yes
Application oracle enterprise_manager_ops_center 12.3.0 Yes
References