Home > Vulnerability Database > CVE-2014-8109

Mend.io Vulnerability Database

CVE-2014-8109

Good to know:

Date: December 29, 2014

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Language: C

Severity Score

7.5

Related Resources (30)

Url: http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159352.html

Url: https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Url: http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html

Url: https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

Url: http://www.securityfocus.com/bid/73040

Url: https://support.apple.com/kb/HT205031

Url: http://www.ubuntu.com/usn/USN-2523-1

Url: https://nvd.nist.gov/vuln/detail/CVE-2014-8109

Url: https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E

Url: http://www.openwall.com/lists/oss-security/2014/11/28/5

Url: https://access.redhat.com/security/cve/CVE-2014-8109

Url: https://security-tracker.debian.org/tracker/CVE-2014-8109

Url: https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcb

Url: http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Url: https://bugzilla.redhat.com/show_bug.cgi?id=1174077

Url: https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

Url: http://advisories.mageia.org/MGASA-2015-0011.html

Url: https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Url: https://issues.apache.org/bugzilla/show_bug.cgi?id=57204

Url: https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E

Url: http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Url: https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E

Url: https://support.apple.com/HT205219

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2014-8109

Url: https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

Url: https://www.mend.io/vulnerability-database/CVE-2014-8109

Severity Score

7.5

Weakness Type (CWE)

Permissions, Privileges, and Access Control

CWE-264

Incorrect Authorization

CWE-863

Top Fix

Upgrade Version

Upgrade to version 2.4.11

Learn More

CVSS v3

Base Score:	7.5
Attack Vector (AV):
Attack Complexity (AC):
Privileges Required (PR):
User Interaction (UI):
Scope (S):
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	PARTIAL

CVSS v2

Base Score:	7.3
Access Vector (AV):
Access Complexity (AC):
Authentication (AU):
Confidentiality (C):	LOW
Integrity (I):	LOW
Availability (A):	LOW
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2014-8109

Good to know:

Date: December 29, 2014

Language: C

Severity Score

Related Resources (30)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3

CVSS v2

Do you need more information?