Every CVE Search/ Get API key

CVE-2014-8109

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not...

4.3 MediumFix available

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Exploit likelihood

22.0%Up 14.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Record
CVE-2014-8109
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-863
Updated
2026-11-02
CVE List No score

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Record
CVE-2014-8109
Updated
2026-11-02
EUVDEUVD-2014-7956 No score

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Record
EUVD-2014-7956
Updated
2026-11-03
GitHub AdvisoriesGHSA-5m8h-wgcr-7x2w No score

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not...

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Record
GHSA-5m8h-wgcr-7x2w
Weakness
CWE-863
Updated
2026-11-02
OSVCLSA-2025-1752126532 No score

httpd: Fix of 2 CVEs

  • CVE-2014-8109: mod_lua: fix LuaAuthzProvider argument handling issue
  • CVE-2019-10092: mod_proxy: fix limited cross-site scripting in mod_proxy error page
Record
CLSA-2025-1752126532
Updated
2026-11-02
OSV No score

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Record
CVE-2014-8109
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-8109 No score

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Record
DEBIAN-CVE-2014-8109
Updated
2026-11-02
OSVMGASA-2015-0011 No score

Updated apache packages fix CVE-2014-8109

Updated apache packages fix security vulnerability:

mod_lua.c in the mod_lua module in the Apache HTTP Server through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory (CVE-2014-8109).

Record
MGASA-2015-0011
Updated
2026-11-02
OSVopenSUSE-SU-2024:10268-1 No score

apache2-2.4.23-4.1 on GA media

These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10268-1
Updated
2026-11-02
OSVSUSE-SU-2015:0974-1 No score

Security update for apache2

Apache2 updated to fix four security issues and one non-security bug.

The following vulnerabilities have been fixed:

  • mod_headers rules could be bypassed via chunked requests. Adds 'MergeTrailers' directive to restore legacy behavior. (bsc#871310, CVE-2013-5704)
  • An empty value in Content-Type could lead to a crash through a null pointer dereference and a denial of service. (bsc#899836, CVE-2014-3581)
  • Remote attackers could bypass intended access restrictions in mod_lua LuaAuthzProvider when multiple Require directives with different arguments are used. (bsc#909715, CVE-2014-8109)
  • Remote attackers could cause a denial of service (child-process crash) by sending a crafted WebSocket Ping frame after a Lua script has called the wsupgrade function. (bsc#918352, CVE-2015-0228)

The following non-security issues have been fixed:

  • The Apache2 systemd service file was changed to fix situation where apache wouldn't start at boot when using an encrypted certificate because the user wasn't prompted for password during boot. (bsc#792309)

Additionally, mod_imagemap is now included by default in the package. (bsc#923090)

Record
SUSE-SU-2015:0974-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
httpd
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.4.6-99.0.5.el7.centos.1.tuxcare.els5
2.4.6-99.0.5.el7.centos.1.tuxcare.els5
httpd-devel
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.4.6-99.0.5.el7.centos.1.tuxcare.els5
2.4.6-99.0.5.el7.centos.1.tuxcare.els5
httpd-manual
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.4.6-99.0.5.el7.centos.1.tuxcare.els5
2.4.6-99.0.5.el7.centos.1.tuxcare.els5
httpd-tools
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.4.6-99.0.5.el7.centos.1.tuxcare.els5
2.4.6-99.0.5.el7.centos.1.tuxcare.els5
mod_ldap
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.4.6-99.0.5.el7.centos.1.tuxcare.els5
2.4.6-99.0.5.el7.centos.1.tuxcare.els5
mod_proxy_html
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1:2.4.6-99.0.5.el7.centos.1.tuxcare.els5
1:2.4.6-99.0.5.el7.centos.1.tuxcare.els5
mod_session
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 2.4.6-99.0.5.el7.centos.1.tuxcare.els5
2.4.6-99.0.5.el7.centos.1.tuxcare.els5
mod_ssl
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1:2.4.6-99.0.5.el7.centos.1.tuxcare.els5
1:2.4.6-99.0.5.el7.centos.1.tuxcare.els5
apache2
Debian:12
 before 2.4.10-9
2.4.10-9
apache2
Debian:13
 before 2.4.10-9
2.4.10-9
Show 6 moreShow less
Affected packages
PackageAffectedFixed
apache2
Debian:14
 before 2.4.10-9
2.4.10-9
apache
Mageia:4
 before 2.4.7-5.5.mga4
2.4.7-5.5.mga4
apache2
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 4 CVEs
 before 2.4.10-12.1
2.4.10-12.1
apache2
SUSE:Linux Enterprise Server 12
From an advisory covering 4 CVEs
 before 2.4.10-12.1
2.4.10-12.1
apache2
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 4 CVEs
 before 2.4.10-12.1
2.4.10-12.1
apache2
openSUSE:Tumbleweed
From an advisory covering 48 CVEs
 before 2.4.23-4.1
2.4.23-4.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-8109 is a medium vulnerability (CVSS 4.3) in Apache Http Server, published December 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.0%, the 97th percentile. Fixed in apache2 2.4.10-9.

References

Show 93 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open