CVE-2012-4528

The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.

Published: Dec 28, 2012
Updated: Apr 13, 2023
CVE: CVE-2012-4528
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:N/I:P/A:N

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
trustwave / modsecurity	-	2.7.0
opensuse / opensuse	12.3	12.3.x
opensuse / opensuse	11.4	11.4.x
opensuse / opensuse	12.2	12.2.x
fedoraproject / fedora	18	18.x

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.html
http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html
http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html
http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
http://mod-security.svn.sourceforge.net/viewvc/mod-security?view=revision&sortby=date&revision=2081
http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGES
http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?sortby=date&r1=2081&r2=2080&pathrev=2081
http://seclists.org/fulldisclosure/2012/Oct/113
http://www.openwall.com/lists/oss-security/2012/10/18/14
https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20121017-0_mod_security_ruleset_bypass.txt

Vulnerability Database

289,697

CVE-2012-4528