Vulnerability Description
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Modsecurity | Owasp Modsecurity Core Rule Set | >= 3.0.0, <= 3.1.0 |
Related Weaknesses (CWE)
References
- https://coreruleset.org/20190627/announcement-owasp-modsecurity-core-rule-set-veRelease NotesVendor Advisory
- https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.1/dev/CHANGESRelease NotesThird Party Advisory
- https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1359Issue TrackingThird Party Advisory
- https://coreruleset.org/20190627/announcement-owasp-modsecurity-core-rule-set-veRelease NotesVendor Advisory
- https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.1/dev/CHANGESRelease NotesThird Party Advisory
- https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1359Issue TrackingThird Party Advisory
FAQ
What is CVE-2019-11387?
CVE-2019-11387 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service (ReDOS) by entering...
How severe is CVE-2019-11387?
CVE-2019-11387 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11387?
Check the references section above for vendor advisories and patch information. Affected products include: Modsecurity Owasp Modsecurity Core Rule Set.