CVE

Id
42466  
CVE No.
CVE-2009-5031  
Status
Candidate  
Description
ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.  
Phase
Assigned (20101209)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
462928 42466 CVE-2009-5031 MLIST:[oss-security] 20120621 Re: mod_security CVE request  View
462929 42466 CVE-2009-5031 URL:http://www.openwall.com/lists/oss-security/2012/06/22/2  View
462930 42466 CVE-2009-5031 MLIST:[oss-security] 20120621 mod_security CVE request  View
462931 42466 CVE-2009-5031 URL:http://www.openwall.com/lists/oss-security/2012/06/22/1  View
462932 42466 CVE-2009-5031 MISC:http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html  View
462933 42466 CVE-2009-5031 MISC:http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf  View
462934 42466 CVE-2009-5031 CONFIRM:http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES  View
462935 42466 CVE-2009-5031 CONFIRM:https://www.modsecurity.org/fisheye/browse/modsecurity/m2/branches/2.5.x/apache2/msc_multipart.c?r2=1419&r1=1366  View
462936 42466 CVE-2009-5031 SUSE:openSUSE-SU-2013:1331  View
462937 42466 CVE-2009-5031 URL:http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html  View
462938 42466 CVE-2009-5031 SUSE:openSUSE-SU-2013:1336  View
462939 42466 CVE-2009-5031 URL:http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html  View
462940 42466 CVE-2009-5031 SUSE:openSUSE-SU-2013:1342  View
462941 42466 CVE-2009-5031 URL:http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html  View
462942 42466 CVE-2009-5031 BID:54156  View
462943 42466 CVE-2009-5031 URL:http://www.securityfocus.com/bid/54156  View
462944 42466 CVE-2009-5031 SECUNIA:49576  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
37139 JVNDB-2010-002924 IBM Lotus Notes Traveler の Nokia クライアントにおける他人への電子メールを読まれる脆弱性 IBM Lotus Notes Traveler の Nokia クライアントは、同期処理の間、複数の送信電子メールメッセージを適切に処理しないため、他人への電子メールを読まれる脆弱性が存在します。 CVE-2009-5035 42466 4.3 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002924.html  View