Read the docs
TI-2008-02287 Aliases CVE-2008-2384GHSA-vm9x-63j8-h9j9

SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka…

Priority LOW 37CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-89.

Summary

SQL injection vulnerability in mod_auth_mysql.c in the mod-auth-mysql (aka libapache2-mod-auth-mysql) module for the Apache HTTP Server 2.x, when configured to use a multibyte character set that allows a \ (backslash) as part of the character encoding, allows remote attackers to execute arbitrary SQL commands via unspecified inputs in a login request.

Why it matters now

EPSS 0.01863 79th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 60

CPEVersionsRoleVendor
cpe:2.3:a:joey_schulze:mod_auth_mysql:*:*:*:*:*:*:*:*all versionsVulnerableJoey Schulze
cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:*not specified by NVDRunning onApache
cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:*2.0Running onApache
cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:*2.0.9Running onApache
cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:*2.0.28Running onApache
cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:*2.0.28 betaRunning onApache
cpe:2.3:a:apache:http_server:2.0.28:beta:win32:*:*:*:*:*2.0.28 betaRunning onApache
cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:*2.0.32Running onApache
cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:*2.0.32 betaRunning onApache
cpe:2.3:a:apache:http_server:2.0.32:beta:win32:*:*:*:*:*2.0.32 betaRunning onApache
  • cpe:2.3:a:joey_schulze:mod_auth_mysql:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Joey Schulze
  • cpe:2.3:a:apache:http_server:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:*:*:*:*:*:*:* Versions 2.0.28 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:beta:*:*:*:*:*:* Versions 2.0.28 beta Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.28:beta:win32:*:*:*:*:* Versions 2.0.28 beta Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.32:*:*:*:*:*:*:* Versions 2.0.32 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.32:beta:*:*:*:*:*:* Versions 2.0.32 beta Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.32:beta:win32:*:*:*:*:* Versions 2.0.32 beta Running on ·Apache
Show 50 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:*2.0.34 betaRunning onApache
cpe:2.3:a:apache:http_server:2.0.34:beta:win32:*:*:*:*:*2.0.34 betaRunning onApache
cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:*2.0.35Running onApache
cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:*2.0.36Running onApache
cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:*2.0.37Running onApache
cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:*2.0.38Running onApache
cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:*2.0.39Running onApache
cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:*2.0.40Running onApache
cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:*2.0.41Running onApache
cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:*2.0.42Running onApache
cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:*2.0.43Running onApache
cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:*2.0.44Running onApache
cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:*2.0.45Running onApache
cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:*2.0.46Running onApache
cpe:2.3:a:apache:http_server:2.0.46:*:win32:*:*:*:*:*2.0.46Running onApache
cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:*2.0.47Running onApache
cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:*2.0.48Running onApache
cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:*2.0.49Running onApache
cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:*2.0.50Running onApache
cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:*2.0.51Running onApache
cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:*2.0.52Running onApache
cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:*2.0.53Running onApache
cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:*2.0.54Running onApache
cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:*2.0.55Running onApache
cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:*2.0.56Running onApache
cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:*2.0.57Running onApache
cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:*2.0.58Running onApache
cpe:2.3:a:apache:http_server:2.0.58:*:win32:*:*:*:*:*2.0.58Running onApache
cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:*2.0.59Running onApache
cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:*2.0.60Running onApache
cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:*2.0.61Running onApache
cpe:2.3:a:apache:http_server:2.1:*:*:*:*:*:*:*2.1Running onApache
cpe:2.3:a:apache:http_server:2.1.1:*:*:*:*:*:*:*2.1.1Running onApache
cpe:2.3:a:apache:http_server:2.1.2:*:*:*:*:*:*:*2.1.2Running onApache
cpe:2.3:a:apache:http_server:2.1.3:*:*:*:*:*:*:*2.1.3Running onApache
cpe:2.3:a:apache:http_server:2.1.4:*:*:*:*:*:*:*2.1.4Running onApache
cpe:2.3:a:apache:http_server:2.1.5:*:*:*:*:*:*:*2.1.5Running onApache
cpe:2.3:a:apache:http_server:2.1.6:*:*:*:*:*:*:*2.1.6Running onApache
cpe:2.3:a:apache:http_server:2.1.7:*:*:*:*:*:*:*2.1.7Running onApache
cpe:2.3:a:apache:http_server:2.1.8:*:*:*:*:*:*:*2.1.8Running onApache
cpe:2.3:a:apache:http_server:2.2:*:*:*:*:*:*:*2.2Running onApache
cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:*2.2.0Running onApache
cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:*2.2.1Running onApache
cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:*2.2.2Running onApache
cpe:2.3:a:apache:http_server:2.2.2:*:windows:*:*:*:*:*2.2.2Running onApache
cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:*2.2.3Running onApache
cpe:2.3:a:apache:http_server:2.2.3:*:windows:*:*:*:*:*2.2.3Running onApache
cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:*2.2.4Running onApache
cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:*2.2.6Running onApache
cpe:2.3:a:apache:http_server:2.3.0:*:*:*:*:*:*:*2.3.0Running onApache
  • cpe:2.3:a:apache:http_server:2.0.34:beta:*:*:*:*:*:* Versions 2.0.34 beta Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.34:beta:win32:*:*:*:*:* Versions 2.0.34 beta Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.35:*:*:*:*:*:*:* Versions 2.0.35 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.36:*:*:*:*:*:*:* Versions 2.0.36 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.37:*:*:*:*:*:*:* Versions 2.0.37 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.38:*:*:*:*:*:*:* Versions 2.0.38 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.39:*:*:*:*:*:*:* Versions 2.0.39 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.40:*:*:*:*:*:*:* Versions 2.0.40 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.41:*:*:*:*:*:*:* Versions 2.0.41 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.42:*:*:*:*:*:*:* Versions 2.0.42 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.43:*:*:*:*:*:*:* Versions 2.0.43 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.44:*:*:*:*:*:*:* Versions 2.0.44 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.45:*:*:*:*:*:*:* Versions 2.0.45 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.46:*:*:*:*:*:*:* Versions 2.0.46 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.46:*:win32:*:*:*:*:* Versions 2.0.46 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.47:*:*:*:*:*:*:* Versions 2.0.47 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.48:*:*:*:*:*:*:* Versions 2.0.48 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.49:*:*:*:*:*:*:* Versions 2.0.49 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.50:*:*:*:*:*:*:* Versions 2.0.50 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.51:*:*:*:*:*:*:* Versions 2.0.51 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.52:*:*:*:*:*:*:* Versions 2.0.52 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.53:*:*:*:*:*:*:* Versions 2.0.53 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.54:*:*:*:*:*:*:* Versions 2.0.54 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.55:*:*:*:*:*:*:* Versions 2.0.55 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.56:*:*:*:*:*:*:* Versions 2.0.56 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.57:*:*:*:*:*:*:* Versions 2.0.57 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.58:*:*:*:*:*:*:* Versions 2.0.58 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.58:*:win32:*:*:*:*:* Versions 2.0.58 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.59:*:*:*:*:*:*:* Versions 2.0.59 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.60:*:*:*:*:*:*:* Versions 2.0.60 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.0.61:*:*:*:*:*:*:* Versions 2.0.61 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.1:*:*:*:*:*:*:* Versions 2.1 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.1.5:*:*:*:*:*:*:* Versions 2.1.5 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.1.6:*:*:*:*:*:*:* Versions 2.1.6 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.1.7:*:*:*:*:*:*:* Versions 2.1.7 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.1.8:*:*:*:*:*:*:* Versions 2.1.8 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.2:*:*:*:*:*:*:* Versions 2.2 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.2.2:*:windows:*:*:*:*:* Versions 2.2.2 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.2.3:*:windows:*:*:*:*:* Versions 2.2.3 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Running on ·Apache
  • cpe:2.3:a:apache:http_server:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Running on ·Apache

Remediation

Red Hat 2 advisories

  • RHSA-2010:1002 Released 2010-12-21 · Red Hat rating Moderate
    mod_auth_mysql security update
    • Red Hat Enterprise Linux Server (v. 6) mod_auth_mysql-1:3.0.0-11.el6_0.1
    • Red Hat Enterprise Linux Workstation (v. 6) mod_auth_mysql-1:3.0.0-11.el6_0.1
  • RHSA-2009:0259 Released 2009-02-11 · Red Hat rating Moderate
    mod_auth_mysql security update
    • Red Hat Enterprise Linux (v. 5 server) mod_auth_mysql-1:3.0.0-3.2.el5_3, mod_auth_mysql-1:3.0.0-3.2.el5_3.i386, mod_auth_mysql-1:3.0.0-3.2.el5_3.ia64 +1
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) mod_auth_mysql-1:3.0.0-3.2.el5_3, mod_auth_mysql-1:3.0.0-3.2.el5_3.i386

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:0259
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2009:0259
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2010:1002
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2010:1002

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-2384
  2. 2026-10-03 Alias added: GHSA-vm9x-63j8-h9j9

References

Patch 1

Advisory 4

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences