Skip to content
Fencer Intel
medium 4.3

CVE-2014-8109 json

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which t…

published 11y ago modified 4mo ago also EUVD-2014-7956

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
22.0%
EPSS 22.0% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Patch / fix

  • oracle enterprise_manager_ops_center 12.1.4
  • apache2 Debian 14, Debian 13, Debian 12 2.4.10-9

debian advisories DEBIAN-CVE-2014-8109

  • apache2 SLES for SAP 12, SLES 12, SLE Software Development Kit 12 2.4.10-12.1

suse advisories SUSE-SU-2015:0974-1

  • apache2 openSUSE Tumbleweed 2.4.23-4.1

opensuse advisories openSUSE-SU-2024:10268-1

Is CVE-2014-8109 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-8109 updated cvss 1.9

httpd: LuaAuthzProvider argument handling issue

  • Red Hat Enterprise Linux 7 httpd, mod_ssl, mod_ldap, httpd-tools, mod_session, httpd-manual, +1 more Red Hat Software Collections httpd24-httpd, httpd24-mod_md, httpd24-mod_ssl, httpd24-mod_ldap, httpd24-httpd-tools, httpd24-mod_session, +2 more
    affected: no fix planned “Will not fix”
  • Red Hat Directory Server 8 httpd Red Hat Enterprise Linux 5 httpd Red Hat Enterprise Linux 6 httpd, mod_ssl, httpd-tools, httpd-manual Red Hat JBoss Enterprise Application Platform 5 httpd Red Hat JBoss Enterprise Application Platform 6 httpd, mod_ssl, mod_ldap, httpd-tools, httpd-manual Red Hat JBoss Enterprise Web Server 1 httpd
    +1 more products
    Red Hat JBoss Enterprise Web Server 2 jbcs-httpd24, jbcs-httpd24-runtime
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

22.02% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.