CVE-2012-2751: debian debian_linux
Vulnerability summary
CVE-2012-2751 is a medium (CVSS 4.3) vulnerability in debian debian_linux. EPSS estimates a 3.30% chance of exploitation in the next 30 days, higher than 88.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 22-07-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.30%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.30% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian3 products
- libapache-mod-security< 2.5.12-1+squeeze1
- modsecurity-apache< 2.6.6-1
- debian_linuxEOL6.0 | 7.0
Opensuse1 product
- opensuseEOL11.4 | 12.2 | 12.3
Oracle1 product
- http_server11.1.1.6.0
Trustwave1 product
- modsecurity< 2.6.6
4 vendors · 6 products
References
17 links- lists.opensuse.org/opensuse-updates/2013-08/msg00031.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-updates/2013-08/msg00020.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGESX Refsource CONFIRMBroken Link
- blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.htmlX Refsource MISCThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlX Refsource CONFIRMThird Party Advisory
Show all 17 references
- mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/CHANGES?r1=1920&r2=1919&pathrev=1920X Refsource CONFIRMBroken Link
- www.mandriva.com/security/advisories?name=MDVSA-2012:118Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2013:150Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
- lists.opensuse.org/opensuse-updates/2013-08/msg00025.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory