NVD

Id
44465  
Name
CVE-2012-2751  
Description
ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2012-07-22  
Modified Date
2013-10-10  
Seq
2012-2751  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
223159 44465 CVE-2012-2751 http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html  View
223160 44465 CVE-2012-2751 openSUSE-SU-2013:1331  View
223161 44465 CVE-2012-2751 openSUSE-SU-2013:1336  View
223162 44465 CVE-2012-2751 openSUSE-SU-2013:1342  View
223163 44465 CVE-2012-2751 http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES  View
223164 44465 CVE-2012-2751 http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?r1=1918&r2=1917&pathrev=1918  View
223165 44465 CVE-2012-2751 http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/CHANGES?r1=1920&r2=1919&pathrev=1920  View
223166 44465 CVE-2012-2751 DSA-2506  View
223167 44465 CVE-2012-2751 MDVSA-2012:118  View
223168 44465 CVE-2012-2751 MDVSA-2013:150  View
223169 44465 CVE-2012-2751 [oss-security] 20120621 mod_security CVE request  View
223170 44465 CVE-2012-2751 [oss-security] 20120621 Re: mod_security CVE request  View
223171 44465 CVE-2012-2751 http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html  View
223172 44465 CVE-2012-2751 54156  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27558 JVNDB-2012-003265 ModSecurity におけるフィルタリングルールを回避される脆弱性 ModSecurity は、PHP で使用する場合、multipart/form-data Content-Type ヘッダを伴うリクエストの Content-Disposition フィールドに含まれるリクエストパラメータの値の先頭のシングルクォートを適切に処理しないため、フィルタリングルールを回避される、およびクロスサイトスクリプティング (XSS) 攻撃などその他の攻撃を実行される脆弱性が存在します。 CVE-2012-2751 55989 CVE-2012-2751 44465 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003265.html 2012-07-22 2014-08-11 View