CVE-2009-5031

ModSecurity < 2.5.11 - Cross-Site Scripting via Single Quote in Multipart Content-Disposition

Title source: llm
STIX 2.1

Description

ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.

References (11)

Core 11
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/54156
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/06/22/2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/49576
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/06/22/1
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html

Scores

EPSS 0.0293
EPSS Percentile 85.6%

Details

CWE
CWE-79
Status published
Products (4)
opensuse/opensuse 11.4
opensuse/opensuse 12.2
opensuse/opensuse 12.3
trustwave/modsecurity < 2.5.11
Published Jul 22, 2012
Tracked Since Feb 18, 2026