Published: 28/12/2012 Updated: 12/02/2021

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 505

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

The mod_security2 module prior to 2.7.0 for the Apache HTTP Server allows remote malicious users to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.

Vulnerable Product	Search on Vulmon	Subscribe to Product
trustwave modsecurity
opensuse opensuse 11.4
opensuse opensuse 12.2
opensuse opensuse 12.3
fedoraproject fedora 18

Debian Bug report logs - #691146 modsecurity-apache: CVE-2012-4528 Package: modsecurity-apache; Maintainer for modsecurity-apache is Alberto Gonzalez Iniesta <agi@inittaborg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Mon, 22 Oct 2012 07:06:02 UTC Severity: grave Tags: patch, security Fixed in version ...

source: wwwsecurityfocuscom/bid/56096/info ModSecurity is prone to a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied input Successful exploits can allow attackers to bypass filtering rules; this may aid in further attacks ModSecurity 268 is vulnerable; other versions may also be affected Proo ...

NVD-CWE-noinfo http://www.openwall.com/lists/oss-security/2012/10/18/14 http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?sortby=date&r1=2081&r2=2080&pathrev=2081 http://mod-security.svn.sourceforge.net/viewvc/mod-security?view=revision&sortby=date&revision=2081 https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20121017-0_mod_security_ruleset_bypass.txt http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGES http://seclists.org/fulldisclosure/2012/Oct/113 http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691146 https://nvd.nist.gov https://www.exploit-db.com/exploits/37949/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2012-4528

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect