CVE-2011-2767

CRITICAL

mod_perl 2.0-2.0.10 - Unauthenticated Remote Code Execution via .htaccess File

Title source: llm
STIX 2.1

Description

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.

References (12)

Core 12
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/09/msg00018.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105195
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3825-1/
Issue Tracking, Mailing List, Third Party Advisory x_refsource_misc
https://bugs.debian.org/644169
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2826
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2825
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:2737
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3825-2/

Scores

CVSS v3 9.8
EPSS 0.0895
EPSS Percentile 94.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (17)
apache/mod_perl 2.0.0 - 2.0.10
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 18.10
debian/debian_linux 8.0
redhat/enterprise_linux 6.0
redhat/enterprise_linux 6.7
redhat/enterprise_linux 7.0
... and 7 more
Published Aug 26, 2018
Tracked Since Feb 18, 2026