Input validation error in ModSecurity - CVE-2013-1915
Published: April 26, 2013 / Updated: August 11, 2020
Vulnerability identifier: #VU42869
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-1915
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
Affected software
ModSecurity
Fedora
mod_security
Fedora
mod_security
How to mitigate CVE-2013-1915
Install update from vendor's website.
mod_security - addressed in versions 2.6.8-3.el5, 2.7.3-1.el6
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101898.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101911.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102616.html
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
- http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
- http://secunia.com/advisories/52847
- http://secunia.com/advisories/52977
- http://www.debian.org/security/2013/dsa-2659
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:156
- http://www.openwall.com/lists/oss-security/2013/04/03/7
- http://www.securityfocus.com/bid/58810
- https://bugzilla.redhat.com/show_bug.cgi?id=947842
- https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES
- https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe