Vulnerability in Mod Security
CVE-2007-1359
Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still processed as normal data by some HTTP parsers including PHP 5.2.0, and possibly parsers in Perl, and Python.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.8 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.066 (93.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 93.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.066 · newest: 0.066 · change: 0.000
Affected products
- Mod Security — versions 1.7, 1.7.1, 1.7.2
References
- www.oracle.com/technetwork/topics/security/cpujul2008-090335.html
- www.vupen.com/english/advisories/2008/2115 (vdb-entry)
- exchange.xforce.ibmcloud.com/vulnerabilities/32872 (vdb-entry)
- www.vupen.com/english/advisories/2007/0868 (vdb-entry)
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp (vendor-advisory)
- www.php-security.org/MOPB/BONUS-12-2007.html (Exploit, Vendor Advisory)
- www.modsecurity.org/blog/archives/2007/03/modsecurity_asc.html
- secunia.com/advisories/25316 (third-party-advisory)
- www.vupen.com/english/advisories/2008/2109/references (vdb-entry)
- secunia.com/advisories/24373 (Vendor Advisory, third-party-advisory)