Login Request a demo
High severity · published Oct 9, 2024
CVE-2024-46292
A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Modsecurity · Trustwave
3.0.12 · source: NVD
Affected product
MO
Modsecurity
Trustwave
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46292
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46292
Vendor Advisory
https://github.com/owasp-modsecurity/ModSecurity/blob/v3/master/README.md
Broken Link
https://github.com/yoloflz101/yoloflz/blob/main/README.md
Vendor Advisory
https://modsecurity.org/20241011/about-cve-2024-46292-2024-october/
More from Modsecurity
7.5
CVE-2025-47947
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx
7.5
CVE-2025-27110
Libmodsecurity is one component of the ModSecurity v3 project
7.5
CVE-2023-24021
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall…
7.5
CVE-2022-48279
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall
7.5
CVE-2021-42717
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects