CVE-2013-1915: XEE
It was reported that the XML files parser of ModSecurity, a security module for the Apache HTTP Server, was vulnerable to XML External Entity attacks. A remote attacker could provide a specially-crafted XML file that, when processed might lead to local files disclosure or, potentially, excessive resources (memory, CPU) consumption.
References: [1] https://bugs.gentoo.org/showbug.cgi?id=464188 [2] https://secunia.com/advisories/52847/ [3] https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES
Relevant upstream patch: [4] https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe
Other sources
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1915?
CVE-2013-1915 has been rated as a medium severity vulnerability due to its potential to disclose local files.
How do I fix CVE-2013-1915?
To mitigate CVE-2013-1915, upgrade ModSecurity to version 2.7.3 or later.
What types of attacks can CVE-2013-1915 be exploited for?
CVE-2013-1915 can be exploited for XML External Entity attacks, leading to local file disclosure.
Which versions of ModSecurity are affected by CVE-2013-1915?
CVE-2013-1915 affects ModSecurity versions prior to 2.7.3.
How can CVE-2013-1915 impact my system security?
Exploitation of CVE-2013-1915 could lead to unauthorized access and disclosure of sensitive local files.