CVE-2012-2751
At a glance
- Source
- NVD
- EPSS
- EPSS 3.30 % · percentile 89 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.
References
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
- http://www.securityfocus.com/bid/54156
- http://www.debian.org/security/2012/dsa-2506
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html
- http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES
- http://secunia.com/advisories/49782
- http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?r1=1918&r2=1917&pathrev=1918
- http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html
- http://www.openwall.com/lists/oss-security/2012/06/22/2
- http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
- http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/CHANGES?r1=1920&r2=1919&pathrev=1920
- http://www.openwall.com/lists/oss-security/2012/06/22/1
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:118
- http://secunia.com/advisories/49576
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2012-2731
- GCVE · GCVE-0-2012-2751
CERT-FR advisories
- CERTA-2013-AVI-247 — Multiples vulnérabilités dans Oracle Fusion Middleware · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:trustwave:modsecurity:*:*:*:*:*:*:*:*< 2.6.6cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:http_server:11.1.1.6.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |