7.5
CVE-2019-13464
- EPSS 1.47%
- Veröffentlicht 09.07.2019 19:15:12
- Zuletzt bearbeitet 21.11.2024 04:24:57
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginAn issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Modsecurity ≫ Owasp Modsecurity Core Rule Set Version3.0.2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.47% | 0.703 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
CWE-434 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1386
https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1391