search

crouchr / learnage

0 stars 0 forks source link

CVE-2012-2751 (Low) detected in ModSecurityv2.5.11 - autoclosed #207

Closed mend-bolt-for-github[bot] closed 2 years ago

mend-bolt-for-github[bot] commented 3 years ago

CVE-2012-2751 - Low Severity Vulnerability

Vulnerable Library - ModSecurityv2.5.11

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence.

Library home page: https://github.com/p0pr0ck5/ModSecurity.git

Found in HEAD commit: a5f2b4a6eb346dbe0def97e83877b169dc4b8f8c

Found in base branch: master

Vulnerable Source Files (1)

/blackrain2020/original-sources-3rd-party/modsecurity-apache_2.5.11/modsecurity-apache_2.5.11/apache2/msc_multipart.c

Vulnerability Details

ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.

Publish Date: 2012-07-22

URL: CVE-2012-2751

CVSS 3 Score Details (3.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2751

Release Date: 2012-07-22

Fix Resolution: 2.6.6

Step up your Open Source Security Game with Mend here

mend-bolt-for-github[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.