CyberSec.Space Logo
CVEブラウザに戻る

CVE-2019-11387

MEDIUM
5.3
CVSS Severity Score
EPSS Score0.1760%
EPSS Percentile16.08th
Published2019年4月21日
Last Modified2024年11月21日

Vulnerability Description

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators.

Affected Platforms (CPE)

📦
Modsecurity

Owasp Modsecurity Core Rule Set

>= 3.0.0 and <= 3.1.0

References & Advisories

🔗 https://coreruleset.org/20190627/announcement-owasp-modsecurity-core-rule-set-version-3-1-1/
🔗 https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.1/dev/CHANGES
🔗 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1359
🔗 https://coreruleset.org/20190627/announcement-owasp-modsecurity-core-rule-set-version-3-1-1/
🔗 https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.1/dev/CHANGES
🔗 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1359

関連する脆弱性情報

CVE-2021-353689.8

OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypas...

CVE-2018-163847.5

A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {...

CVE-2019-134647.5

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PH...

CVE-2019-113915.3

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf all...