CVE-2024-46292 — Classic Buffer Overflow in Modsecurity

CWE-120 — Classic Buffer OverflowCWE-400 — Uncontrolled Resource Consumption5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 25.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Trustwave Modsecurity
Timeline
PublishedOct 9

Description

A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-gmcv-mjv9-gjcv: A buffer overflow in modsecurity v3↗2024-10-09
▶
OSV
CVE-2024-46292: A buffer overflow in modsecurity v3↗2024-10-09
▶
CVEList
CVE-2024-46292: A buffer overflow in modsecurity v3↗2024-10-09
▶

📋Vendor Advisories

1
Red Hat
mod_security: denial of service via name paramter↗2024-10-09
▶