The Apache HTTP Server 2.2.11 and earlier 2.2 versions...
Moderate severity
Unreviewed
Published
May 2, 2022
to the GitHub Advisory Database
•
Updated Feb 20, 2023
Description
Published by the National Vulnerability Database
May 28, 2009
Published to the GitHub Advisory Database
May 2, 2022
Last updated
Feb 20, 2023
The Apache HTTP Server 2.2.11 and earlier 2.2 versions does not properly handle Options=IncludesNOEXEC in the AllowOverride directive, which allows local users to gain privileges by configuring (1) Options Includes, (2) Options +Includes, or (3) Options +IncludesNOEXEC in a .htaccess file, and then inserting an exec element in a .shtml file.
References