QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2012-2751

Back to search

CVE-2012-2751

Published: Jul 22, 2012

Modified: Aug 6, 2024

PUBLISHED

Description

ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.

VendorProductVersions

n/a

n/a

affected
n/a

References

openSUSE-SU-2013:1342
vendor-advisory
x_refsource_SUSE
54156
vdb-entry
x_refsource_BID
DSA-2506
vendor-advisory
x_refsource_DEBIAN
openSUSE-SU-2013:1331
vendor-advisory
x_refsource_SUSE
49782
third-party-advisory
x_refsource_SECUNIA
MDVSA-2012:118
vendor-advisory
x_refsource_MANDRIVA
49576
third-party-advisory
x_refsource_SECUNIA
MDVSA-2013:150
vendor-advisory
x_refsource_MANDRIVA
openSUSE-SU-2013:1336
vendor-advisory
x_refsource_SUSE

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now