CVE-2019-25043 — Improper Handling of Exceptional Conditions in Modsecurity

CWE-755 — Improper Handling of Exceptional Conditions5 documents5 sources

Severity

5.3MEDIUMNVD

EPSS

0.4%

top 40.36%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Trustwave Modsecurity Owasp Modsecurity

Timeline

PublishedMay 6

Latest updateMay 24

Description

ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDowasp/modsecurity3.0.0 — 3.0.4

▶Debiantrustwave/modsecurity< 3.0.4-1+3

🔴Vulnerability Details

GHSA

GHSA-p89w-8r2h-7mjp: ModSecurity 3↗2022-05-24

▶

CVEList

CVE-2019-25043: ModSecurity 3↗2021-05-06

▶

OSV

CVE-2019-25043: ModSecurity 3↗2021-05-06

▶

📋Vendor Advisories

Debian

CVE-2019-25043: modsecurity - ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated ...↗2019

▶