CVE-2019-11391: Medium severity owasp modsecurity core rule set vulnerability
DISPUTED An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with $a# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11391?
CVE-2019-11391 is considered a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2019-11391?
To mitigate CVE-2019-11391, upgrade OWASP ModSecurity Core Rule Set to a version higher than 3.1.0.
What is the impact of CVE-2019-11391?
CVE-2019-11391 allows remote attackers to exploit the vulnerability leading to denial of service.
Is CVE-2019-11391 still an issue in the latest versions of OWASP ModSecurity Core Rule Set?
No, CVE-2019-11391 is resolved in versions of OWASP ModSecurity Core Rule Set released after 3.1.0.
What specific configurations are affected by CVE-2019-11391?
CVE-2019-11391 affects the REQUEST-933-APPLICATION-ATTACK-PHP.conf configuration file in the OWASP ModSecurity Core Rule Set.