CVE-2025-54571

MEDIUM

Owasp Modsecurity < 2.9.12 - XSS

Title source: rule

Description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.

References (4)

[Patch] https://github.com/owasp-modsecurity/ModSecurity/commit/6d7e8eb18f2d7d368fb8e29516fcdeaeb8d349b8

View Patch ZIP pw:eip

[Exploit, Issue Tracking] https://github.com/owasp-modsecurity/ModSecurity/issues/2514

[Exploit, Vendor Advisory] https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cg44-9m43-3f9v

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/09/msg00008.html

Scores

CVSS v3 6.1

EPSS 0.0006

EPSS Percentile 17.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-252 CWE-79

Status published

Affected Products (1)

owasp/modsecurity < 2.9.12

Timeline

Published Aug 06, 2025

Tracked Since Feb 18, 2026