PT-2018-13536 · Owasp · Owasp Modsecurity Core Rule Set

Published 2018-09-03 · Updated 2024-03-18 · CVE-2018-16384

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OWASP ModSecurity Core Rule Set versions prior to 3.1.0-rc4

Description A SQL injection bypass issue exists, allowing attackers to bypass security controls. This is achieved by using a special syntax {ab}, where ais a special function name, such asif, and b` is the SQL statement to be executed.

Recommendations For versions prior to 3.1.0-rc4, update to a version that includes the fix for this issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-16384

DLA-3293-1

MGASA-2024-0070

Affected Products

Owasp Modsecurity Core Rule Set

References · 36

• 🔥 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1167 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13464 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-16384 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39956 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-16384 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16384 · Security Note
• https://osv.dev/vulnerability/DLA-3293-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0070 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/C4Q7DCCE37GT5ZBJOWP4NGUD4L3FAMDB · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/modsecurity-crs · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29956 · Security Note
• https://debian.org/lts/security/2023/dla-3293 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39958 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16384 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16384 · Vendor Advisory