mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Feb 2, 2015 | Dec 29, 2014 |
| Apple Osx Apache | — | Apply OS X security update 2015-006Upgrade macOS to the latest version | Aug 28, 2015 | Dec 29, 2014 |
| Debian | — | Upgrade apache2 | Jul 30, 2024 | Dec 29, 2014 |
| Freebsd | — | Upgrade apache24 | Dec 10, 2025 | Jan 31, 2015 |
| Huawei Euleros 2_0_sp1 | — | Upgrade httpd-develUpgrade httpdUpgrade httpd-toolsUpgrade httpd-manualUpgrade mod_ssl | Nov 30, 2017 | Dec 29, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade mod_sessionUpgrade httpd-manualUpgrade httpd-toolsUpgrade mod_sslUpgrade httpdUpgrade httpd-devel | Nov 19, 2019 | Dec 29, 2014 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Dec 29, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 12, 2014 |
| Suse | — | Upgrade apache2-develUpgrade apache2-example-pagesUpgrade apache2-docUpgrade apache2-utilsUpgrade apache2-workerUpgrade apache2-preforkUpgrade apache2Upgrade apache2-event | Dec 18, 2015 | Dec 29, 2014 |
| Ubuntu | — | Upgrade apache2.2-bin | Nov 8, 2024 | Dec 29, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub