NVD

Id
53544  
Name
CVE-2007-1359  
Description
Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still processed as normal data by some HTTP parsers including PHP 5.2.0, and possibly parsers in Perl, and Python.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-03-08  
Modified Date
2012-10-22  
Seq
2007-1359  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
271306 53544 CVE-2007-1359 SSRT061201  View
271307 53544 CVE-2007-1359 GLSA-200705-17  View
271308 53544 CVE-2007-1359 http://www.modsecurity.org/blog/archives/2007/03/modsecurity_asc.html  View
271309 53544 CVE-2007-1359 http://www.oracle.com/technetwork/topics/security/cpujul2008-090335.html  View
271310 53544 CVE-2007-1359 http://www.php-security.org/MOPB/BONUS-12-2007.html  View
271311 53544 CVE-2007-1359 22831  View
271312 53544 CVE-2007-1359 ADV-2007-0868  View
271313 53544 CVE-2007-1359 ADV-2008-2109  View
271314 53544 CVE-2007-1359 ADV-2008-2115  View
271315 53544 CVE-2007-1359 modsecurity-formurlencoded-security-bypass(32872)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
52488 JVNDB-2007-001180 ModSecurity におけるリクエストルールを回避される脆弱性 ModSecurity (mod_security) には、ASCIIZ (0x00) バイトを含む application/x-www-form-urlencoded POST データの取り扱いに不備があり、リクエストルールを回避される脆弱性が存在します。 CVE-2007-1359 24714 CVE-2007-1359 53544 6.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001180.html 2007-03-08 2008-08-11 View