REDHAT-BUG-2455909: High severity Erlang OTP (inets) vulnerability
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via scriptalias.
When scriptalias maps a URL prefix to a directory outside DocumentRoot, modauth evaluates directory-based access controls against the DocumentRoot-relative path while modcgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.
This vulnerability is associated with program files lib/inets/src/httpserver/modalias.erl, lib/inets/src/httpserver/modauth.erl, and lib/inets/src/httpserver/modcgi.erl.
This issue affects OTP from OTP 17.0 until OTP 28.4.2, 27.3.4.10 and 26.2.5.19 corresponding to inets from 5.10 until 9.6.2, 9.3.2.4 and 9.1.0.6.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2455909?
The severity of REDHAT-BUG-2455909 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2455909?
To fix REDHAT-BUG-2455909, ensure that directory-based access controls are correctly configured and that CGI scripts are not exposed outside the DocumentRoot.
What impact does REDHAT-BUG-2455909 have on my system?
REDHAT-BUG-2455909 allows unauthenticated users to access protected CGI scripts, potentially leading to unauthorized access and exploitation.
What software is affected by REDHAT-BUG-2455909?
REDHAT-BUG-2455909 affects the Erlang OTP (inets) software.
When was REDHAT-BUG-2455909 published?
REDHAT-BUG-2455909 was published on April 7, 2026.