CVEvulnerability

CVE-2024-46292

7.5 HIGH Published 2024-10-09 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2024-10-09
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses: CWE-120

Description

A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).

Affected configurations

• trustwave modsecurity 3.0.12

Weakness · CWE (1)

CWE-120 Buffer Copy without Checking Size of Input weakness

References

https://github.com/owasp-modsecurity/ModSecurity/blob/v3/master/README.md Vendor Advisory
https://github.com/yoloflz101/yoloflz/blob/main/README.md Broken Link
https://modsecurity.org/20241011/about-cve-2024-46292-2024-october/ Vendor Advisory

CVE-2024-46292

Description

Affected configurations

Related

Weakness · CWE (1)

References