NVD

Id
52144  
Name
CVE-2009-5031  
Description
ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2012-07-22  
Modified Date
2013-09-11  
Seq
2009-5031  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
263272 52144 CVE-2009-5031 http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html  View
263273 52144 CVE-2009-5031 openSUSE-SU-2013:1331  View
263274 52144 CVE-2009-5031 openSUSE-SU-2013:1336  View
263275 52144 CVE-2009-5031 openSUSE-SU-2013:1342  View
263276 52144 CVE-2009-5031 http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES  View
263277 52144 CVE-2009-5031 [oss-security] 20120621 mod_security CVE request  View
263278 52144 CVE-2009-5031 [oss-security] 20120621 Re: mod_security CVE request  View
263279 52144 CVE-2009-5031 54156  View
263280 52144 CVE-2009-5031 http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf  View
263281 52144 CVE-2009-5031 https://www.modsecurity.org/fisheye/browse/modsecurity/m2/branches/2.5.x/apache2/msc_multipart.c?r2=1419&r1=1366  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
27557 JVNDB-2012-003264 ModSecurity におけるフィルタリングルールを回避される脆弱性 ModSecurity は、リクエストパラメータの値にシングルクォートを含むファイルを扱うため、フィルタリングルールを回避される、およびクロスサイトスクリプティング (XSS) 攻撃などその他の攻撃を実行される脆弱性が存在します。 CVE-2009-5031 42462 CVE-2009-5031 52144 5 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003264.html 2012-07-22 2012-07-24 View