CVE-2012-4528
N/A
Published: December 28, 2012 at 11:00 AM UTC
Updated: June 16, 2026 at 11:45 PM UTC
3 products affected across 3 vendorsFedoraopenSUSEModsecurity
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 12%
Description
The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
95%
v < 2.7.0
Affected range stops below 2.7.0, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (10)
Vendor Advisoryx_refsource_FEDORAThird Party Advisory
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.htmlVendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.htmlVendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.htmlVendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory
Source: [email protected]
http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.htmlx_refsource_CONFIRMBroken Link
Source: [email protected]
http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGESx_refsource_CONFIRMBroken Link
Source: [email protected]
http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?sortby=date&r1=2081&r2=2080&pathrev=2081x_refsource_CONFIRMBroken Link
Source: [email protected]
http://mod-security.svn.sourceforge.net/viewvc/mod-security?view=revision&sortby=date&revision=2081Mailing Listx_refsource_FULLDISCExploitThird Party Advisory
Source: [email protected]
http://seclists.org/fulldisclosure/2012/Oct/113Quick Info
StatusMODIFIED
CWE
NVD-CWE-noinfo
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card