Unscored severity · published Jul 22, 2012
CVE-2009-5031
ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such…
–
CVSS
2.9%
EPSS
No
On KEV
Description
ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Modsecurity · Trustwave
before 2.5.11 · source: NVD
OP
Opensuse · Opensuse
11.4; 12.2; 12.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-5031
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-5031
Third Party Advisory
http://blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
Broken Link
http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES
Third Party Advisory
http://secunia.com/advisories/49576
More from Opensuse
9.8
CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2016-3427
Oracle Java SE and JRockit Unspecified Vulnerability
9.8
CVE-2015-2590
Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
9.8
CVE-2015-5119
Adobe Flash Player Use-After-Free Vulnerability