// For flags

CVE-2020-15598

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit

**EN DISPUTA** Trustwave ModSecurity versiones 3.x hasta 3.0.4, permite una denegación de servicio por medio de una petición especial. NOTA: El descubridor reporta que "Trustwave has signaled they are disputing our claims." El CVE sugiere que se presenta un problema de seguridad en como ModSecurity maneja unas expresiones regulares que pueden resultar en una condición de Denegación de Servicio. El proveedor no considera esto como un problema de seguridad porque 1) aquí no se presenta ningún problema de configuración predeterminada. Un atacante necesitaría saber que se presenta una regla que usa una expresión regular potencialmente problemática, 2) el atacante necesitaría conocer la naturaleza básica de la expresión regular en sí misma para explotar cualquier recurso. Es bien sabido que el uso de la expresión regular puede estar gravando los recursos del sistema, independientemente del caso de uso. Corresponde al administrador decidir cuándo es apropiado canjear los recursos para obtener un posible beneficio de seguridad

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-07-07 CVE Reserved
  • 2020-09-15 CVE Published
  • 2024-02-09 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Trustwave
Search vendor "Trustwave"
Modsecurity
Search vendor "Trustwave" for product "Modsecurity"
>= 3.0.0 <= 3.0.4
Search vendor "Trustwave" for product "Modsecurity" and version " >= 3.0.0 <= 3.0.4"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
10.0
Search vendor "Debian" for product "Debian Linux" and version "10.0"
-
Affected