CVE-2014-8109

CVE-2014-8109 describes an access restriction bypass vulnerability in the mod_lua module of Apache HTTP Server versions 2.3.x and 2.4.x up to 2.4.10, affecting products from Apache, Canonical, Fedora Project, and Oracle. This flaw allows remote attackers to bypass intended access controls in specific configurations where the same Lua authorization provider is used with different arguments across multiple contexts. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity, requiring no authentication, and resulting in partial integrity impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the CISA KEV catalog, though it has received minimal community discussion and media coverage.