Published: 22/07/2012 Updated: 12/02/2021

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

ModSecurity prior to 2.5.11 treats request parameter values containing single quotes as files, which allows remote malicious users to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.

Vulnerable Product	Search on Vulmon	Subscribe to Product
trustwave modsecurity
opensuse opensuse 11.4
opensuse opensuse 12.2
opensuse opensuse 12.3

CWE-79 http://www.openwall.com/lists/oss-security/2012/06/22/2 http://www.securityfocus.com/bid/54156 http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html https://www.modsecurity.org/fisheye/browse/modsecurity/m2/branches/2.5.x/apache2/msc_multipart.c?r2=1419&r1=1366 http://secunia.com/advisories/49576 http://www.openwall.com/lists/oss-security/2012/06/22/1 http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2009-5031

Vulnerability Summary

Vulnerability Trend

References

Vulmon Search

About

Products

Connect