CVE-2014-8109 : mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd confi

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Published 2014-12-29 23:59:00

Updated 2023-02-13 00:42:41

Source Red Hat, Inc.

View at NVD, CVE.org

Threat overview for CVE-2014-8109

Top countries where our scanners detected CVE-2014-8109

Top open port discovered on systems with this issue 80

IPs affected by CVE-2014-8109 2,948,565

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2014-8109!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2014-8109

Probability of exploitation activity in the next 30 days: 0.22%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 59 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2014-8109

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2014-8109

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-8109

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Oracle Critical Patch Update - January 2016
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E

svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/-Apache Mail Archives

CVEs referencing this url
http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html

Apple - Lists.apple.com
Broken Link;Mailing List

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2523-1

USN-2523-1: Apache HTTP Server vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_

CVEs referencing this url
http://advisories.mageia.org/MGASA-2015-0011.html

Mageia Advisory: MGASA-2015-0011 - Updated apache packages fix CVE-2014-8109
Third Party Advisory
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=1174077

1174077 – (CVE-2014-8109) CVE-2014-8109 httpd: LuaAuthzProvider argument handling issue
Issue Tracking;Patch;Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159352.html

[SECURITY] Fedora 21 Update: httpd-2.4.12-1.fc21
Mailing List;Third Party Advisory
https://support.apple.com/kb/HT205031

About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006 - Apple Support
Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/73040

Apache HTTP Server 'mod_lua.c' Local Access Bypass Vulnerability
Third Party Advisory;VDB Entry
https://issues.apache.org/bugzilla/show_bug.cgi?id=57204

57204 – LuaAuthzProvider mixes up parsed require arguments when used multiple times
Issue Tracking;Vendor Advisory
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/-Apache Mail Archives

CVEs referencing this url
https://support.apple.com/HT205219

About the security content of OS X Server v5.0.3 - Apple Support
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_2
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_

CVEs referencing this url
https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E

svn commit: r1888194 [9/13] - /httpd/site/trunk/content/security/json/-Apache Mail Archives

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2014/11/28/5

oss-security - CVE Request: "LuaAuthzProvider" in Apache HTTP Server mixes up arguments
Mailing List;Third Party Advisory
http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Apple - Lists.apple.com
Broken Link;Mailing List

CVEs referencing this url
https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcb

Merge r1642499 from trunk: · apache/httpd@3f1693d · GitHub
Patch;Third Party Advisory
https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E

svn commit: r1073139 [9/13] - in /websites/staging/httpd/trunk/content: ./ security/json/-Apache Mail Archives

CVEs referencing this url
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_

CVEs referencing this url
https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E

svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html

CVEs referencing this url
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/-Apache Mail Archives

CVEs referencing this url
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html s

CVEs referencing this url

Products affected by CVE-2014-8109