Detections
Analytics

CVE-2012-4528

high

Description

The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.

References

https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20121017-0_mod_security_ruleset_bypass.txt

http://www.openwall.com/lists/oss-security/2012/10/18/14

http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.html

http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.html

http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.html

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.html

https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-4456

http://seclists.org/fulldisclosure/2012/Oct/113

http://mod-security.svn.sourceforge.net/viewvc/mod-security?view=revision&sortby=date&revision=2081

http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?sortby=date&r1=2081&r2=2080&pathrev=2081

http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGES

Details

Source: Mitre, NVD

Published: 2012-12-28

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Severity: High

EPSS

EPSS: 0.12507