Published: 28/12/2012 Updated: 12/02/2021
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 505
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

Vulnerability Summary

The mod_security2 module prior to 2.7.0 for the Apache HTTP Server allows remote malicious users to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

trustwave modsecurity

opensuse opensuse 11.4

opensuse opensuse 12.2

opensuse opensuse 12.3

fedoraproject fedora 18

Vendor Advisories

Debian Bug report logs - #691146 modsecurity-apache: CVE-2012-4528 Package: modsecurity-apache; Maintainer for modsecurity-apache is Alberto Gonzalez Iniesta <agi@inittaborg>; Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Mon, 22 Oct 2012 07:06:02 UTC Severity: grave Tags: patch, security Fixed in version ...


source: wwwsecurityfocuscom/bid/56096/info ModSecurity is prone to a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied input Successful exploits can allow attackers to bypass filtering rules; this may aid in further attacks ModSecurity 268 is vulnerable; other versions may also be affected Proo ...