CVE-2011-2767

mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.

• CWE-94

• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html
• http://www.securityfocus.com/bid/105195Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2737Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2825Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2826Third Party Advisory
• https://bugs.debian.org/644169Issue Tracking, Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2018/09/msg00018.htmlMailing List, Third Party Advisory
• https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3EMailing List, Third Party Advisory
• https://usn.ubuntu.com/3825-1/Third Party Advisory
• https://usn.ubuntu.com/3825-2/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html
• http://www.securityfocus.com/bid/105195Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2737Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2825Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2826Third Party Advisory
• https://bugs.debian.org/644169Issue Tracking, Mailing List, Third Party Advisory
• https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2018/09/msg00018.htmlMailing List, Third Party Advisory
• https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3EMailing List, Third Party Advisory
• https://usn.ubuntu.com/3825-1/Third Party Advisory
• https://usn.ubuntu.com/3825-2/Third Party Advisory

Published

Aug 26, 2018

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-2761Google Chrome 14.0.794.0 does not properly handle a reload o…
• CVE-2011-2762The web interface on the LifeSize Room appliance LS_RM1_3.5.…
• CVE-2011-2763The web interface on the LifeSize Room appliance LS_RM1_3.5.…
• CVE-2011-2764The FS_CheckFilenameIsNotExecutable function in qcommon/file…
• CVE-2011-2765pyro before 3.15 unsafely handles pid files in temporary dir…
• CVE-2011-2766The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, a…
• CVE-2011-2768Tor before 0.2.2.34, when configured as a client or bridge, …
• CVE-2011-2769Tor before 0.2.2.34, when configured as a bridge, accepts th…
• CVE-2011-2770Cross-site scripting (XSS) vulnerability in man2html.cgi.c i…
• CVE-2011-2771Multiple cross-site scripting (XSS) vulnerabilities in Mahar…
• CVE-2011-2772The get_dataroot_image_path function in lib/file.php in Maha…
• CVE-2011-2773Cross-site request forgery (CSRF) vulnerability in Mahara be…