CVE-2024-46292: trustwave modsecurity Classic Buffer Overflow

Vulnerability summary

CVE-2024-46292 is a high (CVSS 7.5) Classic Buffer Overflow vulnerability in trustwave modsecurity. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.3% of scored vulnerabilities.

Timeline

1. 09-10-2024
   PublishedVulnerability first disclosed.
2. 20-10-2024
   Last modifiedVulnerability information updated.

Description

A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).

• CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.