CVE-2011-2767: apache mod_perl Improper Control of Generation of Code

Modified

AliasesMGASA-2018-0474SUSE-SU-2019:3213-1SUSE-SU-2020:14266-1+9 more

Published 26-08-2018Last modified 06-08-2024

Vulnerability summary

CVE-2011-2767 is a high (CVSS 10.0) Improper Control of Generation of Code vulnerability in apache mod_perl. EPSS estimates a 8.83% chance of exploitation in the next 30 days, higher than 95.2% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (NVD); no exploitation reported by the 5 checked sources; EPSS 9% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

8.83%

0%100%

Low · -0.11 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10626-1

Timeline

26-08-2018
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.

CVSS metrics

5 scores · 4 sources · 2 versions

v3.09.8v2.010.0

EPSS trend

Probability

8.83%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

Decrease -0.11 pp

From 8.95% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat13 products

enterprise_linuxEOL6.0 | 6.7 | 7.0 | 7.3 | 7.4 | 7.5 | 7.6
enterprise_linux_desktop6.0
enterprise_linux_server6.0
enterprise_linux_workstation6.0
mod_perl< 0:2.0.4-12.el6_10

Show all 13

Suse10 products

apache2-mod_perl&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.0.4-40.63.3.3
apache2-mod_perl&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 2.0.4-40.63.3.3
apache2-mod_perl&distro=SUSE Linux Enterprise Server 12 SP4< 2.0.8-13.5.1
apache2-mod_perl&distro=SUSE Linux Enterprise Server 12 SP5< 2.0.8-13.5.1
apache2-mod_perl&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 2.0.8-13.5.1

Show all 10

Debian2 products

libapache2-mod-perl2< 2.0.9~1624218-2+deb8u3 | < 2.0.10-3
debian_linuxEOL8.0

Opensuse2 products

apache2-mod_perl&distro=openSUSE Leap 15.0< 2.0.11-lp151.3.3.1
apache2-mod_perl&distro=openSUSE Leap 15.1< 2.0.11-lp151.3.3.1

Apache1 product

mod_perl≥ 2.0.0, ≤ 2.0.10

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10

Mageia1 product

apache-mod_perl< 2.0.10-1.1.mga6

Ubuntu1 product

libapache2-mod-perl2< 2.0.8+httpd24-r1449661-6ubuntu2.1 | < 2.0.9-4ubuntu1.2 | < 2.0.10-2ubuntu3.18.04.1

8 vendors · 31 products

References

35 links

lists.debian.org/debian-lts-announce/2018/09/msg00018.htmlMailing ListX Refsource MLISTThird Party Advisory
www.securityfocus.com/bid/105195VDB EntryX Refsource BIDThird Party Advisory
usn.ubuntu.com/3825-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
bugs.debian.org/644169X Refsource MISCIssue TrackingMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2018:2826Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
mail-archives.apache.org/mod_mbox/…X Refsource MISCMailing ListThird Party Advisory
access.redhat.com/errata/RHSA-2018:2825Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
access.redhat.com/errata/RHSA-2018:2737Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
usn.ubuntu.com/3825-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST

Show all 35 references

lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.htmlVendor AdvisoryX Refsource SUSE
advisories.mageia.org/MGASA-2018-0474.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=23541REPORT
lists.fedoraproject.org/archives/…WEB
www.suse.com/support/update/announcement/2019/suse-su-20193213-1/Advisory
bugzilla.suse.com/1091625REPORT
bugzilla.suse.com/1156944REPORT
www.suse.com/security/cve/CVE-2011-2767WEB
www.suse.com/support/update/announcement/2020/suse-su-202014266-1/Advisory
lists.opensuse.org/archives/…Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1623265REPORT
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2737.jsonAdvisory
access.redhat.com/security/cve/CVE-2011-2767REPORT
www.cve.org/CVERecord?id=CVE-2011-2767AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2011-2767Advisory
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2825.jsonAdvisory
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2826.jsonAdvisory
ubuntu.com/security/CVE-2011-2767REPORT
mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/%3C20111004084343.GA21290%40ktnx.net%3EREPORT
ubuntu.com/security/notices/USN-3825-1Advisory
ubuntu.com/security/notices/USN-3825-2Advisory
security-tracker.debian.org/tracker/CVE-2011-2767Advisory
lists.opensuse.org/archives/…Advisory