CVE-2013-1915
Fixed in a distro release EPSS 4%
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
Products: trustwave modsecurity, opensuse, fedoraproject fedora, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | modsecurity-apache | 2.6.6-6 |
| Debian 13 | modsecurity-apache | 2.6.6-6 |
| Debian 14 | modsecurity-apache | 2.6.6-6 |
| Debian 6.0 | libapache-mod-security | 2.5.12-1+squeeze2 |
| openSUSE Tumbleweed | apache2-mod_security2 | 2.9.0-5.6 |