CVE-2019-11390: Medium severity owasp modsecurity core rule set vulnerability
DISPUTED An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with seterrorhandler# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11390?
CVE-2019-11390 is classified as a denial of service vulnerability that can affect the availability of the application.
How do I fix CVE-2019-11390?
To fix CVE-2019-11390, upgrade to a later version of the OWASP ModSecurity Core Rule Set that is greater than 3.1.0.
What software is affected by CVE-2019-11390?
CVE-2019-11390 impacts the OWASP ModSecurity Core Rule Set versions up to and including 3.1.0.
What are the potential impacts of CVE-2019-11390?
The potential impact of CVE-2019-11390 includes the possibility of remote attackers causing a denial of service through specially crafted inputs.
Is CVE-2019-11390 a known issue?
Yes, CVE-2019-11390 is a reported issue and has been discussed in multiple issue trackers related to OWASP ModSecurity.