CVE-2013-5705
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by...
CVE-2013-5705 is a medium vulnerability (CVSS 5.0) in Trustwave Modsecurity, published April 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.72%, the 86th percentile. Fixed in modsecurity-apache 2.7.7-1.
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
Exploit likelihood
What each source reports
NVD Score used
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
- Record
CVE-2013-5705- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
- Record
CVE-2013-5705- Updated
- 2026-11-02
EUVDEUVD-2013-5542 No score
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
- Record
EUVD-2013-5542- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-36h6-r4f5-cjrw No score
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by...
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
- Record
GHSA-36h6-r4f5-cjrw- Updated
- 2026-11-02
OSV No score
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
- Record
CVE-2013-5705- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-5705 No score
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
- Record
DEBIAN-CVE-2013-5705- Updated
- 2026-11-02
OSVMGASA-2014-0180 No score
Updated apache-mod_security packages fix security vulnerability
Updated apache-mod_security packages fix security vulnerability:
Martin Holst Swende discovered a flaw in the way mod_security handled chunked requests. A remote attacker could use this flaw to bypass intended mod_security restrictions, allowing them to send requests containing content that should have been removed by mod_security (CVE-2013-5705).
- Record
MGASA-2014-0180- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-5705 No score
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.
- Record
UBUNTU-CVE-2013-5705- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
modsecurity-apacheDebian:12 |
before 2.7.7-1 | 2.7.7-1 |
modsecurity-apacheDebian:13 |
before 2.7.7-1 | 2.7.7-1 |
modsecurity-apacheDebian:14 |
before 2.7.7-1 | 2.7.7-1 |
libapache-mod-securityDebian:6.0 |
before 2.5.12-1+squeeze4, plus listed versions 2.5.12-12.5.12-1+squeeze12.5.12-1+squeeze22.5.12-1+squeeze3 |
2.5.12-1+squeeze4 |
modsecurity-apacheDebian:7 |
before 2.6.6-6+deb7u2, plus listed versions 2.6.6-62.6.6-6+deb7u1 |
2.6.6-6+deb7u2 |
apache-mod_securityMageia:3 |
before 2.7.4-1.1.mga3 | 2.7.4-1.1.mga3 |
apache-mod_securityMageia:4 |
before 2.7.5-2.1.mga4 | 2.7.5-2.1.mga4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |