CVEvulnerability
CVE-2011-2767
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-08-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-94
Description
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
Affected configurations
• apache mod perl (>= 2.0.0 <= 2.0.10)
• debian debian linux 8.0
• redhat enterprise linux 6.0
• redhat enterprise linux 6.7
• redhat enterprise linux 7.0
• redhat enterprise linux 7.3
• redhat enterprise linux 7.4
• redhat enterprise linux 7.5
• redhat enterprise linux 7.6
• redhat enterprise linux desktop 6.0
• redhat enterprise linux server 6.0
• redhat enterprise linux workstation 6.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 18.10
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html lists.opensuse.org
- http://www.securityfocus.com/bid/105195 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2737 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2825 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2826 Third Party Advisory
- https://bugs.debian.org/644169 Issue Tracking, Mailing List, Third Party Advisory
- https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E lists.apache.org
- https://lists.debian.org/debian-lts-announce/2018/09/msg00018.html Mailing List, Third Party Advisory
- https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3E Mailing List, Third Party Advisory
- https://usn.ubuntu.com/3825-1/ Third Party Advisory
- https://usn.ubuntu.com/3825-2/ Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html lists.opensuse.org
- http://www.securityfocus.com/bid/105195 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2737 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2825 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2826 Third Party Advisory
- https://bugs.debian.org/644169 Issue Tracking, Mailing List, Third Party Advisory
- https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E lists.apache.org
- https://lists.debian.org/debian-lts-announce/2018/09/msg00018.html Mailing List, Third Party Advisory
- https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3E Mailing List, Third Party Advisory
- https://usn.ubuntu.com/3825-1/ Third Party Advisory
- https://usn.ubuntu.com/3825-2/ Third Party Advisory