PT-2025-32001 · Apache+5 · Apache+5

Orangetw · Publicado 2025-08-05 · Atualizado 2025-10-09 · CVE-2025-54571

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ModSecurity versions 2.9.11 and below

Description ModSecurity is a web application firewall engine for Apache, IIS, and Nginx. An attacker can override the HTTP response’s Content-Type, potentially leading to issues such as cross-site scripting (XSS) and arbitrary script source code disclosure.

Recommendations Update to version 2.9.12 or later.

Exploit

Correção

XSS

Unchecked Return Value

Enumeração de Fraquezas

CWE-79

CWE-252

Identificadores relacionados

AZL-66087

AZL-66111

BIT-MODSECURITY-2025-54571

BIT-MODSECURITY2-2025-54571

CVE-2025-54571

DLA-4294-1

GHSA-CG44-9M43-3F9V

OESA-2025-2012

OESA-2025-2013

OESA-2025-2014

OESA-2025-2015

OESA-2025-2016

OESA-2025-2062

OPENSUSE-SU-2025:15456-1

SUSE-SU-2025:03422-1

SUSE-SU-2025:03423-1

SUSE-SU-2025_03422-1

SUSE-SU-2025_03423-1

Produtos afetados

Apache

Debian

Iis

Modsecurity

Nginx

Suse

Referências · 46

• 🔥 https://github.com/owasp-modsecurity/ModSecurity/issues/2514 · Exploit
• 🔥 https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cg44-9m43-3f9v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54571.json · Exploit
• https://github.com/owasp-modsecurity/ModSecurity/commit/6d7e8eb18f2d7d368fb8e29516fcdeaeb8d349b8 · Correção
• https://suse.com/support/update/announcement/2025/suse-su-202503423-1 · Nota
• https://twitter.com/zeeshankghouri/status/1972862021499760957 · Publicação no Twitter
• https://osv.dev/vulnerability/OESA-2025-2062 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54571 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2025/suse-su-202503422-1 · Nota
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2014 · Nota
• https://t.me/cveNotify/131016 · Publicação no Telegram
• https://osv.dev/vulnerability/SUSE-SU-2025:03423-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2025-2016 · Aviso do Fabricante
• https://bugzilla.suse.com/1247674 · Nota
• https://twitter.com/Cezar_H_Linux/status/1973439812209414172 · Publicação no Twitter