CVE-2019-13464: Malicious File Upload
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of XFilename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-13464?
CVE-2019-13464 has a medium severity rating due to its ability to bypass certain PHP Script Uploads rules.
How do I fix CVE-2019-13464?
To fix CVE-2019-13464, ensure that your ModSecurity Core Rule Set is updated to a version that addresses this issue.
What impact does CVE-2019-13464 have on my application?
CVE-2019-13464 may allow an attacker to bypass file upload restrictions, potentially leading to unauthorized file uploads.
Which version of ModSecurity Core Rule Set is affected by CVE-2019-13464?
CVE-2019-13464 specifically affects OWASP ModSecurity Core Rule Set version 3.0.2.
Is CVE-2019-13464 a critical vulnerability?
CVE-2019-13464 is not classified as critical, but it still poses a considerable risk if exploited.