1. Home
  2. CVE Database
  3. CVE-2019-13464
HIGH · 7.5

CVE-2019-13464

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into...

Vulnerability Description

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
ModsecurityOwasp Modsecurity Core Rule Set3.0.2

Related Weaknesses (CWE)

CWE-434

References

FAQ

What is CVE-2019-13464?

CVE-2019-13464 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into...

How severe is CVE-2019-13464?

CVE-2019-13464 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-13464?

Check the references section above for vendor advisories and patch information. Affected products include: Modsecurity Owasp Modsecurity Core Rule Set.