CVE-2012-2751

MEDIUM 4.3CVE-2012-2751 · Published 22/07/2012 · updated 16/06/2026

In short

CVE-2012-2751 is a MEDIUM (CVSS 4.3) vulnerability affecting http server (oracle), modsecurity (trustwave).
Chance of exploitation in the next 30 days (EPSS): 3.3%, higher than 88.5% of all vulnerabilities.
Fix: update to 2.6.6 or later.

Package	Affected versions	Patched versions
http server oracle	`= 11.1.1.6.0`	No fix yet
modsecurity trustwave	`< 2.6.6`	`2.6.6`

Description

ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.

References

blog.ivanristic.com/2012/06/modsecurity-and-modsecurity-core-rule-set-multipart-bypasses.html · Third Party Advisory
lists.opensuse.org/opensuse-updates/2013-08/msg00020.html · Mailing List
lists.opensuse.org/opensuse-updates/2013-08/msg00025.html · Mailing List
lists.opensuse.org/opensuse-updates/2013-08/msg00031.html · Mailing List
mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.6.x/CHANGES · Broken Link
mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/CHANGES · Broken Link
mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c · Broken Link
secunia.com/advisories/49576 · Third Party Advisory
secunia.com/advisories/49782 · Third Party Advisory
debian.org/security/2012/dsa-2506

More vulnerabilities in http server

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free