CVE-2011-2767
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a...
CVE-2011-2767 is a critical vulnerability (CVSS 9.8) in Apache Mod Perl, published August 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.83%, the 95th percentile. Fixed in libapache2-mod-perl2 2.0.10-3.
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
- Record
CVE-2011-2767- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
- Record
CVE-2011-2767- Updated
- 2026-11-02
EUVDEUVD-2011-2741 No score
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
- Record
EUVD-2011-2741- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hm7f-5jxx-cwvg
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a...
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
- Record
GHSA-hm7f-5jxx-cwvg- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
- Record
CVE-2011-2767- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2767
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
- Record
DEBIAN-CVE-2011-2767- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSVRHSA-2018:2737
Red Hat Security Advisory: mod_perl security update
- Record
RHSA-2018:2737- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2018:2825
Red Hat Security Advisory: rh-perl526-mod_perl security update
- Record
RHSA-2018:2825- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2018:2826
Red Hat Security Advisory: rh-perl524-mod_perl security update
- Record
RHSA-2018:2826- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2011-2767
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
- Record
UBUNTU-CVE-2011-2767- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0474 No score
Updated apache-mod_perl packages fix security vulnerability
A flaw was found in mod_perl 2.0 through 2.0.10 which allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes (CVE-2011-2767).
- Record
MGASA-2018-0474- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2549-1 No score
Security update for apache2-mod_perl
This update for apache2-mod_perl to version 2.0.11 fixes the following issues:
Security issue fixed:
- CVE-2011-2767: Fixed a vulnerability which could have allowed perl code execution in the context of user account (bsc#1156944).
Other issue addressed:
- Restore process name after sv_setpv_mg() call. (bsc#1091625)
- Record
openSUSE-SU-2019:2549-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2558-1 No score
Security update for apache2-mod_perl
This update for apache2-mod_perl to version 2.0.11 fixes the following issues:
Security issue fixed:
- CVE-2011-2767: Fixed a vulnerability which could have allowed perl code execution in the context of user account (bsc#1156944).
Other issue addressed:
- Restore process name after sv_setpv_mg() call. (bsc#1091625)
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:2558-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10626-1 No score
apache2-mod_perl-2.0.11-2.12 on GA media
These are all security issues fixed in the apache2-mod_perl-2.0.11-2.12 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10626-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:3213-1 No score
Security update for apache2-mod_perl
This update for apache2-mod_perl fixes the following issues:
Security issue fixed:
- CVE-2011-2767: Fixed a vulnerability which could have allowed perl code execution in the context of user account (bsc#1156944).
Other issue addressed:
- Restore process name after sv_setpv_mg() call. (bsc#1091625)
- Record
SUSE-SU-2019:3213-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:14266-1 No score
Security update for apache2-mod_perl
This update for apache2-mod_perl fixes the following issues:
- CVE-2011-2767: Fixed a vulnerability which could have allowed perl code execution in the context of user account (bsc#1156944).
- Record
SUSE-SU-2020:14266-1- Updated
- 2026-11-02
OSVUSN-3825-1 No score
libapache2-mod-perl2 vulnerability
Jan Ingvoldstad discovered that mod_perl incorrectly handled configuration options to disable being used by unprivileged users, contrary to the documentation. A local attacker could possibly use this issue to execute arbitrary Perl code.
- Record
USN-3825-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-perl2Debian:12 |
before 2.0.10-3 | 2.0.10-3 |
libapache2-mod-perl2Debian:13 |
before 2.0.10-3 | 2.0.10-3 |
libapache2-mod-perl2Debian:14 |
before 2.0.10-3 | 2.0.10-3 |
libapache2-mod-perl2Debian:8 |
before 2.0.9~1624218-2+deb8u3, plus listed versions 2.0.9~1624218-22.0.9~1624218-2+deb8u12.0.9~1624218-2+deb8u2 |
2.0.9~1624218-2+deb8u3 |
apache-mod_perlMageia:6 |
before 2.0.10-1.1.mga6 | 2.0.10-1.1.mga6 |
mod_perlRed Hat:enterprise_linux:6::client |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perl-debuginfoRed Hat:enterprise_linux:6::client |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perl-develRed Hat:enterprise_linux:6::client |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perlRed Hat:enterprise_linux:6::computenode |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perl-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_perl-develRed Hat:enterprise_linux:6::computenode |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perlRed Hat:enterprise_linux:6::server |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perl-debuginfoRed Hat:enterprise_linux:6::server |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perl-develRed Hat:enterprise_linux:6::server |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perlRed Hat:enterprise_linux:6::workstation |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perl-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
mod_perl-develRed Hat:enterprise_linux:6::workstation |
before 0:2.0.4-12.el6_10 | 0:2.0.4-12.el6_10 |
rh-perl526-mod_perlRed Hat:rhel_software_collections:3::el7 |
before 0:2.0.10-10.el7 | 0:2.0.10-10.el7 |
rh-perl526-mod_perl-debuginfoRed Hat:rhel_software_collections:3::el7 |
before 0:2.0.10-10.el7 | 0:2.0.10-10.el7 |
rh-perl526-mod_perl-develRed Hat:rhel_software_collections:3::el7 |
before 0:2.0.10-10.el7 | 0:2.0.10-10.el7 |
rh-perl524-mod_perlRed Hat:rhel_software_collections:3::el6 |
before 0:2.0.9-10.el6 | 0:2.0.9-10.el6 |
rh-perl524-mod_perl-debuginfoRed Hat:rhel_software_collections:3::el6 |
before 0:2.0.9-10.el6 | 0:2.0.9-10.el6 |
rh-perl524-mod_perl-develRed Hat:rhel_software_collections:3::el6 |
before 0:2.0.9-10.el6 | 0:2.0.9-10.el6 |
rh-perl524-mod_perlRed Hat:rhel_software_collections:3::el7 |
before 0:2.0.9-10.el7 | 0:2.0.9-10.el7 |
rh-perl524-mod_perl-debuginfoRed Hat:rhel_software_collections:3::el7 |
before 0:2.0.9-10.el7 | 0:2.0.9-10.el7 |
rh-perl524-mod_perl-develRed Hat:rhel_software_collections:3::el7 |
before 0:2.0.9-10.el7 | 0:2.0.9-10.el7 |
apache2-mod_perlSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 2.0.8-13.5.1 | 2.0.8-13.5.1 |
apache2-mod_perlSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.0.8-13.5.1 | 2.0.8-13.5.1 |
apache2-mod_perlSUSE:Linux Enterprise Server 12 SP4 |
before 2.0.8-13.5.1 | 2.0.8-13.5.1 |
apache2-mod_perlSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.0.8-13.5.1 | 2.0.8-13.5.1 |
apache2-mod_perlSUSE:Linux Enterprise Server 12 SP5 |
before 2.0.8-13.5.1 | 2.0.8-13.5.1 |
apache2-mod_perlSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.0.8-13.5.1 | 2.0.8-13.5.1 |
apache2-mod_perlSUSE:Linux Enterprise Point of Sale 11 SP3 |
before 2.0.4-40.63.3.3 | 2.0.4-40.63.3.3 |
apache2-mod_perlSUSE:Linux Enterprise Server 11 SP4-LTSS |
before 2.0.4-40.63.3.3 | 2.0.4-40.63.3.3 |
libapache2-mod-perl2Ubuntu:14.04:LTS |
before 2.0.8+httpd24-r1449661-6ubuntu2.1, plus listed versions 2.0.8+httpd24-r1449661-6ubuntu12.0.8+httpd24-r1449661-6ubuntu2 |
2.0.8+httpd24-r1449661-6ubuntu2.1 |
libapache2-mod-perl2Ubuntu:16.04:LTS |
before 2.0.9-4ubuntu1.2, plus listed versions 2.0.9-1ubuntu12.0.9-4ubuntu12.0.9-4ubuntu1.1 |
2.0.9-4ubuntu1.2 |
libapache2-mod-perl2Ubuntu:18.04:LTS |
before 2.0.10-2ubuntu3.18.04.1, plus listed versions 2.0.10-2ubuntu22.0.10-2ubuntu3 |
2.0.10-2ubuntu3.18.04.1 |
apache2-mod_perlopenSUSE:Leap 15.0 |
before 2.0.11-lp151.3.3.1 | 2.0.11-lp151.3.3.1 |
apache2-mod_perlopenSUSE:Leap 15.1 |
before 2.0.11-lp151.3.3.1 | 2.0.11-lp151.3.3.1 |
apache2-mod_perlSUSE:Package Hub 15 |
before 2.0.11-bp151.4.3.1 | 2.0.11-bp151.4.3.1 |
apache2-mod_perlSUSE:Package Hub 15 SP1 |
before 2.0.11-bp151.4.3.1 | 2.0.11-bp151.4.3.1 |
apache2-mod_perlopenSUSE:Tumbleweed |
before 2.0.11-2.12 | 2.0.11-2.12 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.debian.org/debian-lts-announce/2018/09/msg00018.html
securityfocus.com/bid/105195
usn.ubuntu.com/3825-1
bugs.debian.org/644169
access.redhat.com/errata/RHSA-2018:2826
mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3E
Show 32 moreShow less
lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E
lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html
nvd.nist.gov/vuln/detail/CVE-2011-2767
github.com/advisories/GHSA-hm7f-5jxx-cwvg
security-tracker.debian.org/tracker/CVE-2011-2767
advisories.mageia.org/MGASA-2018-0474.html
bugs.mageia.org/show_bug.cgi?id=23541
lists.fedoraproject.org/archives/list/[email protected]/thread/G3GS7G4X3FRAUBMBVQ4QXZAGZH2JIMG4
bugzilla.redhat.com/show_bug.cgi?id=1623265
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2737.json
cve.org/CVERecord?id=CVE-2011-2767
suse.com/support/update/announcement/2019/suse-su-20193213-1
bugzilla.suse.com/1091625
ubuntu.com/security/CVE-2011-2767