NVD

Id
38050  
Name
CVE-2013-1915  
Description
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-04-25  
Modified Date
2013-11-30  
Seq
2013-1915  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
194414 38050 CVE-2013-1915 FEDORA-2013-4834  View
194415 38050 CVE-2013-1915 FEDORA-2013-4831  View
194416 38050 CVE-2013-1915 FEDORA-2013-4908  View
194417 38050 CVE-2013-1915 openSUSE-SU-2013:1331  View
194418 38050 CVE-2013-1915 openSUSE-SU-2013:1336  View
194419 38050 CVE-2013-1915 openSUSE-SU-2013:1342  View
194420 38050 CVE-2013-1915 DSA-2659  View
194421 38050 CVE-2013-1915 MDVSA-2013:156  View
194422 38050 CVE-2013-1915 [oss-security] 20130403 Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks  View
194423 38050 CVE-2013-1915 58810  View
194424 38050 CVE-2013-1915 https://bugzilla.redhat.com/show_bug.cgi?id=947842  View
194425 38050 CVE-2013-1915 https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES  View
194426 38050 CVE-2013-1915 https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
20914 JVNDB-2013-002489 ModSecurity における任意のファイルを読まれる脆弱性 ModSecurity には、任意のファイルを読まれる、インターネット上のサーバに HTTP リクエストを送信される、またはサービス運用妨害 (CPU およびメモリ消費) 状態にされる脆弱性が存在します。 CVE-2013-1915 61857 CVE-2013-1915 38050 7.5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002489.html 2013-03-28 2014-08-11 View