CVE-2014-8109: apache http_server Incorrect Authorization
Vulnerability summary
CVE-2014-8109 is a medium (CVSS 4.3) Incorrect Authorization vulnerability in apache http_server. EPSS estimates a 22.02% chance of exploitation in the next 30 days, higher than 97.6% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 29-12-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
22.02%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 22.02% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Apache1 product
- http_server2.4.1 | 2.4.2 | 2.4.3 | 2.4.4 | 2.4.6 | 2.4.7 | 2.4.9 | 2.4.10
Canonical1 product
- ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10
Debian1 product
- apache2< 2.4.10-9
Fedoraproject1 product
- fedoraEOL21
Mageia1 product
- apache< 2.4.7-5.5.mga4
Oracle1 product
- enterprise_manager_ops_center< 12.1.4 | 12.2.0 | 12.2.1 | 12.3.0
6 vendors · 6 products
References
30 links- github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcbX Refsource CONFIRMPatchThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1174077X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlX Refsource CONFIRMThird Party Advisory
- lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
Show all 30 references
- lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
- lists.fedoraproject.org/pipermail/package-announce/2015-June/159352.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
