A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).
References
| Link | Resource |
|---|---|
| https://github.com/owasp-modsecurity/ModSecurity/blob/v3/master/README.md | Vendor Advisory |
| https://github.com/yoloflz101/yoloflz/blob/main/README.md | Broken Link |
| https://modsecurity.org/20241011/about-cve-2024-46292-2024-october/ | Vendor Advisory |
Configurations
History
No history.
Information
Published : 2024-10-09 16:15
Updated : 2025-06-17 15:49
NVD link : CVE-2024-46292
Mitre link : CVE-2024-46292
CVE.ORG link : CVE-2024-46292
JSON object : View
Products Affected
trustwave
- modsecurity
CWE
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')