What is CVE-2024-46292?

CVE-2024-46292 is a high-severity vulnerability in Trustwave Modsecurity, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.5/10. Published 2024-10-09.

How severe is CVE-2024-46292?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2024-46292 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Trustwave Modsecurity

CVE-2024-46292

A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).

Vulnerability class: Buffer Overflow

EPSS: 0.008 (53.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Affected products

Trustwave Modsecurity — versions 3.0.12
N/a — versions n/a

Weakness classification (CWE)

CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

cve@mitre.org (Vendor Advisory)
cve@mitre.org (Broken Link)
cve@mitre.org (Vendor Advisory)

Frequently asked questions

What is CVE-2024-46292?: CVE-2024-46292 is a high-severity vulnerability in Trustwave Modsecurity, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.5/10. Published 2024-10-09.
How severe is CVE-2024-46292?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2024-46292 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.