CVE - CVE-2013-1915

CVE-ID
CVE-2013-1915	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:58810 URL:http://www.securityfocus.com/bid/58810 CONFIRM:https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES CONFIRM:https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe DEBIAN:DSA-2659 URL:http://www.debian.org/security/2013/dsa-2659 FEDORA:FEDORA-2013-4831 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101911.html FEDORA:FEDORA-2013-4834 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101898.html FEDORA:FEDORA-2013-4908 URL:http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102616.html MANDRIVA:MDVSA-2013:156 URL:~~http://www.mandriva.com/security/advisories?name=MDVSA-2013:156~~ (Obsolete source) MISC:https://bugzilla.redhat.com/show_bug.cgi?id=947842 MLIST:[oss-security] 20130403 Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks URL:http://www.openwall.com/lists/oss-security/2013/04/03/7 SECUNIA:52847 URL:http://secunia.com/advisories/52847 SECUNIA:52977 URL:http://secunia.com/advisories/52977 SUSE:openSUSE-SU-2013:1331 URL:http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html SUSE:openSUSE-SU-2013:1336 URL:http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html SUSE:openSUSE-SU-2013:1342 URL:http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
Assigning CNA
Red Hat, Inc.
Date Record Created
20130219	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20130219)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)