CVE-2013-1915

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.

ModSecurity antes de v2.7.3 permite a atacantes remotos leer archivos arbitrarios, enviar peticiones HTTP a los servidores de la intranet, o causar una denegación de servicio (consumo de CPU y memoria) a través de una declaración de entidad externa XML junto con una referencia de entidad, también conocido como una Entidad Externa XML (XXE) vulnerabilidad.

*Credits: N/A

CVSS Scores

NISTv2 7.5

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-02-19 CVE Reserved
2013-04-11 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-611: Improper Restriction of XML External Entity Reference

CAPEC

References (15)

URL	Tag	Source
http://secunia.com/advisories/52847	Third Party Advisory
http://secunia.com/advisories/52977	Third Party Advisory
http://www.securityfocus.com/bid/58810	Third Party Advisory
https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES	Release Notes

URL	Date	SRC

URL	Date	SRC
http://www.openwall.com/lists/oss-security/2013/04/03/7	2021-02-12
https://bugzilla.redhat.com/show_bug.cgi?id=947842	2021-02-12
https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe	2021-02-12

URL	Date	SRC
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101898.html	2021-02-12
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101911.html	2021-02-12
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102616.html	2021-02-12
http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html	2021-02-12
http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html	2021-02-12
http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html	2021-02-12
http://www.debian.org/security/2013/dsa-2659	2021-02-12
http://www.mandriva.com/security/advisories?name=MDVSA-2013:156	2021-02-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Trustwave Search vendor "Trustwave"		Modsecurity Search vendor "Trustwave" for product "Modsecurity"				< 2.7.3 Search vendor "Trustwave" for product "Modsecurity" and version " < 2.7.3"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				11.4 Search vendor "Opensuse" for product "Opensuse" and version "11.4"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				12.2 Search vendor "Opensuse" for product "Opensuse" and version "12.2"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				12.3 Search vendor "Opensuse" for product "Opensuse" and version "12.3"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				17 Search vendor "Fedoraproject" for product "Fedora" and version "17"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				18 Search vendor "Fedoraproject" for product "Fedora" and version "18"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				19 Search vendor "Fedoraproject" for product "Fedora" and version "19"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				6.0 Search vendor "Debian" for product "Debian Linux" and version "6.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				7.0 Search vendor "Debian" for product "Debian Linux" and version "7.0"		-		Affected