7.5

CVE-2013-1915

ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Trustwave ≫ Modsecurity Version < 2.7.3
Opensuse ≫ Opensuse Version11.4
Opensuse ≫ Opensuse Version12.2
Opensuse ≫ Opensuse Version12.3
Fedoraproject ≫ Fedora Version17
Fedoraproject ≫ Fedora Version18
Fedoraproject ≫ Fedora Version19
Debian ≫ Debian Linux Version6.0
Debian ≫ Debian Linux Version7.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.21% 0.897
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-611 Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
Third Party Advisory
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101898.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101911.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102616.html
Third Party Advisory
http://secunia.com/advisories/52847
Third Party Advisory
http://secunia.com/advisories/52977
Third Party Advisory
http://www.debian.org/security/2013/dsa-2659
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:156
Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/04/03/7
Patch
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/58810
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=947842
Patch
Third Party Advisory
Issue Tracking
https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES
Third Party Advisory
Release Notes
https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe
Patch
Third Party Advisory