Published: 22/07/2012 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

ModSecurity prior to 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote malicious users to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.

Vulnerable Product	Search on Vulmon	Subscribe to Product
trustwave modsecurity
opensuse opensuse 12.3
opensuse opensuse 11.4
opensuse opensuse 12.2
debian debian linux 7.0
debian debian linux 6.0
oracle http server 11.1.1.6.0

Debian Bug report logs - #678527 [CVE-2012-2751] mod_security multi-part bypass Package: modsecurity-apache; Maintainer for modsecurity-apache is Alberto Gonzalez Iniesta <agi@inittaborg>; Reported by: Luciano Bello <luciano@debianorg> Date: Fri, 22 Jun 2012 13:27:01 UTC Severity: grave Tags: patch, security Fixed ...

Qualys Vulnerability & Malware Research Labs discovered a vulnerability in ModSecurity, a security module for the Apache webserver In situations where both Content:Disposition: attachment and Content-Type: multipart were present in HTTP headers, the vulnerability could allow an attacker to bypass policy and execute cross-site script (XSS) atta ...

NVD-CWE-Other http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/CHANGES?r1=1920&r2=1919&pathrev=1920 http://www.securityfocus.com/bid/54156 http://secunia.com/advisories/49576 http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html http://www.openwall.com/lists/oss-security/2012/06/22/2 http://www.debian.org/security/2012/dsa-2506 http://secunia.com/advisories/49782 http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?r1=1918&r2=1917&pathrev=1918 http://www.openwall.com/lists/oss-security/2012/06/22/1 http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES http://www.mandriva.com/security/advisories?name=MDVSA-2012:118 http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html http://www.mandriva.com/security/advisories?name=MDVSA-2013:150 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678527 https://nvd.nist.gov https://www.debian.org/security/./dsa-2506

CVE-2012-2751

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect