CVE-2020-15598
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit
**EN DISPUTA** Trustwave ModSecurity versiones 3.x hasta 3.0.4, permite una denegación de servicio por medio de una petición especial. NOTA: El descubridor reporta que "Trustwave has signaled they are disputing our claims." El CVE sugiere que se presenta un problema de seguridad en como ModSecurity maneja unas expresiones regulares que pueden resultar en una condición de Denegación de Servicio. El proveedor no considera esto como un problema de seguridad porque 1) aquí no se presenta ningún problema de configuración predeterminada. Un atacante necesitaría saber que se presenta una regla que usa una expresión regular potencialmente problemática, 2) el atacante necesitaría conocer la naturaleza básica de la expresión regular en sí misma para explotar cualquier recurso. Es bien sabido que el uso de la expresión regular puede estar gravando los recursos del sistema, independientemente del caso de uso. Corresponde al administrador decidir cuándo es apropiado canjear los recursos para obtener un posible beneficio de seguridad
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-07-07 CVE Reserved
- 2020-09-15 CVE Published
- 2024-02-09 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
http://packetstormsecurity.com/files/159185/ModSecurity-3.0.x-Denial-Of-Service.html | Third Party Advisory | |
http://seclists.org/fulldisclosure/2020/Sep/32 | Mailing List | |
https://www.debian.org/security/2020/dsa-4765 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://coreruleset.org/20200914/cve-2020-15598 | 2024-08-04 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://www.modsecurity.org | 2024-05-17 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Trustwave Search vendor "Trustwave" | Modsecurity Search vendor "Trustwave" for product "Modsecurity" | >= 3.0.0 <= 3.0.4 Search vendor "Trustwave" for product "Modsecurity" and version " >= 3.0.0 <= 3.0.4" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
|