CVE-2019-11388: Medium severity owasp modsecurity core rule set vulnerability
DISPUTED An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11388?
CVE-2019-11388 is classified as a medium severity vulnerability due to its potential to cause denial of service through crafted input.
How do I fix CVE-2019-11388?
To mitigate CVE-2019-11388, update to a version of OWASP ModSecurity Core Rule Set that is higher than 3.1.0.
What type of attack does CVE-2019-11388 allow?
CVE-2019-11388 allows for remote denial of service (ReDOS) attacks by exploiting nested repetition operators in regex patterns.
Which versions of OWASP ModSecurity Core Rule Set are affected by CVE-2019-11388?
CVE-2019-11388 affects versions of OWASP ModSecurity Core Rule Set up to and including 3.1.0.
Is CVE-2019-11388 a confirmed issue?
CVE-2019-11388 is marked as disputed, indicating there may be ongoing discussions regarding its impact or validity.