7.5high
CVE-2024-46292
A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name par…
Published 2 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.8%
percentile 57%
Public exploits
0
none known
Summary
A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.82% probability of exploitation in the next 30 days, higher than 57% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- modsecurity modsecurity
Classification
- Weakness
- CWE-120 Buffer Copy without Checking Size of Input
References
- github.com /owasp-modsecurity/ModSecurity/blob/v3/master/README.md
- github.com /yoloflz101/yoloflz/blob/main/README.md
- modsecurity.org /20241011/about-cve-2024-46292-2024-october/
Sources
- CVE List: CVE-2024-46292
- NVD: CVE-2024-46292
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.