CVE-2014-8109 - CVE House

Back to Database

Status published Medium CVE-2014-8109

mod_lua.c in the mod_lua module in the Apache HTTP Server...

4.3 CVSS

Vulnerability Description

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2014-8109

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from apache

View All →

Amq: privilege escalation via excessive /etc/passwd permissions

Generation of Error Message Containing Sensitive Information in Apache OFBiz

In Apache Teaclave Rust SGX SDK 1.1.3, a side-channel vulnerability...

Baidu Rust SGX SDK through 1.0.8 has an enclave ID...

CouchDB in Vectra Networks Cognito Brain and Sensor before 4.3...

Affected Vendor

apache

View all reports →

Affected Software

http server, ubuntu linux, fedora, enterprise manager ops center

Vulnerable Versions:

2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.6, 2.4.7, 2.4.9, 2.4.10, 10.04, 12.04, 14.04, 14.10, 21, 0, 12.2.0, 12.2.1, 12.3.0

Timeline

Official Publish: December 29th, 2014

Last Modified: August 6th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.