CVE-2025-54571
EUVD-2025-2366206.08.2025, 00:15
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| owasp | modsecurity | 2.0.0 ≤ 𝑥 < 2.9.12 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Amazon Linux Releases
Amazon Package | |||||
|---|---|---|---|---|---|
| mod_security |
| ||||
| mod_security-debuginfo |
| ||||
| mod_security-debugsource |
| ||||
| mod_security-mlogc |
| ||||
| mod_security-mlogc-debuginfo |
|
Common Weakness Enumeration
- CWE-252 - Unchecked Return ValueThe software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
References