5
CVSSv2

CVE-2020-15598

Published: 06/10/2020 Updated: 14/10/2020
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

** DISPUTED ** Trustwave ModSecurity 3.x up to and including 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

trustwave modsecurity

debian debian linux 10.0

Vendor Advisories

Ervin Hegedues discovered that ModSecurity v3 enabled global regular expression matching which could result in denial of service For additional information please refer to corerulesetorg/20200914/cve-2020-15598/ For the stable distribution (buster), this problem has been fixed in version 303-1+deb10u2 We recommend that you upgrade your ...

Mailing Lists

ModSecurity v30x is affected by a Denial of Service vulnerability due to the global matching of regular expressions The combination of a non-anchored regular expression and the ModSecurity “capture” action can be exploited via a specially crafted payload While ModSecurity v2x used to quit the execution of a regular expression after the fi ...

Github Repositories

PENTESTING-BIBLE Explore more than 2000 hacking articles saved over time as PDF BROWSE HISTORY Created By Ammar Amer (Twitter @cry__pto) Support Paypal: -1- 3 Ways Extract Password Hashes from NTDSdit: wwwhackingarticlesin/3-ways-extract-password-hashes-from-ntds-dit -2- 3 ways to Capture HTTP Password in Network PC: wwwhackingarticlesin/3-ways-to-captu

PENTESTING-BIBLE Explore more than 2000 hacking articles saved over time as PDF BROWSE HISTORY Created By Ammar Amer (Twitter @cry__pto) Support Paypal: -1- 3 Ways Extract Password Hashes from NTDSdit: wwwhackingarticlesin/3-ways-extract-password-hashes-from-ntds-dit -2- 3 ways to Capture HTTP Password in Network PC: wwwhackingarticlesin/3-ways-to-captu