Vulnerability in Trustwave Modsecurity
CVE-2012-4528
The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.125 (96.2th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.125 · newest: 0.125 · change: 0.000
Affected products
- Trustwave Modsecurity
- Fedoraproject Fedora — versions 18
- openSUSE — versions 11.4, 12.2, 12.3
References
- lists.opensuse.org/opensuse-updates/2013-08/msg00031.html (vendor-advisory, Mailing List, Third Party Advisory)
- www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20121017-0_mod_s… (Third Party Advisory)
- mod-security.svn.sourceforge.net/viewvc/mod-security (Broken Link)
- lists.opensuse.org/opensuse-updates/2013-08/msg00020.html (vendor-advisory, Mailing List, Third Party Advisory)
- mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGES (Broken Link)
- mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multi… (Broken Link)
- seclists.org/fulldisclosure/2012/Oct/113 (mailing-list, Exploit, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.html (vendor-advisory, Third Party Advisory)
- www.openwall.com/lists/oss-security/2012/10/18/14 (mailing-list, Mailing List, Third Party Advisory)
- lists.opensuse.org/opensuse-updates/2013-08/msg00025.html (vendor-advisory, Mailing List, Third Party Advisory)