CVE-2012-4528

Published Dec 28, 2012 trustwave

Overview

CVE-2012-4528 is a known-severity vulnerability affecting trustwave modsecurity. It was published on December 28, 2012.

Technical Description

The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.

Remediation

Check the references section for vendor advisories and patches from trustwave. Update modsecurity to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
trustwave	modsecurity	>= 0, < 2.7.0	Affected

References

Ref lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.html Ref lists.opensuse.org/opensuse-updates/2013-08/msg00020.html Ref lists.opensuse.org/opensuse-updates/2013-08/msg00025.html Ref lists.opensuse.org/opensuse-updates/2013-08/msg00031.html Ref mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGES Ref mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?sortby=date&r1=2081&r2=2080&pathrev=2081 Ref mod-security.svn.sourceforge.net/viewvc/mod-security?view=revision&sortby=date&revision=2081 Ref seclists.org/fulldisclosure/2012/Oct/113 Ref www.openwall.com/lists/oss-security/2012/10/18/14 Ref www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20121017-0_mod_security_ruleset_bypass.txt

Frequently Asked Questions

What is CVE-2012-4528?

CVE-2012-4528 is a known-severity vulnerability affecting trustwave modsecurity. It was published on December 28, 2012.

How severe is CVE-2012-4528?

CVSS score information is not yet available for this vulnerability. Check back as the CVE record is updated by NVD analysts.

How do I fix or remediate CVE-2012-4528?

How can CyberStrike help with CVE-2012-4528?

CyberStrike's AI-powered security agents can automatically detect CVE-2012-4528 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.