CVE-2025-54571

Katalog CVE

CVSS 6.1 · Medium EPSS 0,31%

Kerentanan Unchecked Return Value pada owasp modsecurity. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.

Rincian

Terbit di NVD

6 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-252: Unchecked Return Value
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cg44-9m43-3f9v exploit · advisory vendor
• https://github.com/owasp-modsecurity/ModSecurity/commit/6d7e8eb18f2d7d368fb8e29516fcdeaeb8d349b8 patch
• https://github.com/owasp-modsecurity/ModSecurity/issues/2514 exploit · issue tracking
• https://lists.debian.org/debian-lts-announce/2025/09/msg00008.html