UpHeron
All vulnerabilities

Servers and applications

CVE-2014-8109

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a…

Severity
Medium 4.3
Published
29 Dec 2014
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • Version 2.4.10
  • Version 2.4.9
  • Version 2.4.7
  • Version 2.4.6
All 8 release lines
  • Version 2.4.1
  • Version 2.4.2
  • Version 2.4.3
  • Version 2.4.4
  • Version 2.4.6
  • Version 2.4.7
  • Version 2.4.9
  • Version 2.4.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2014-8109
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2014-8109