CVE-2013-1915 — libapache-mod-security - XML external entity processing vulnerability

描述

ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.

如何修補 CVE-2013-1915

要修補 CVE-2013-1915,請將受影響套件升級到下列已修補版本。

Debian/libapache-mod-security—升級至 2.5.12-1+squeeze2 或更新版本
Debian/modsecurity-apache—升級至 2.6.6-6 或更新版本

CVE-2013-1915 正在被利用嗎?

低 — EPSS 為 4.2%,目前沒有觀察到大規模利用活動。

受影響套件(2)

from 0, < 2.5.12-1+squeeze2
from 0, < 2.6.6-6

參考連結(1)

ADVISORYsecurity-tracker.debian.org/tracker/CVE-2013-1915