CVE-2013-1915
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to...
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
Exploit likelihood
What each source reports
NVD Score used
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
- Record
CVE-2013-1915- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
- Record
CVE-2013-1915- Updated
- 2026-11-02
EUVDEUVD-2013-1909 No score
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
- Record
EUVD-2013-1909- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mmcg-c68q-4p38 No score
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to...
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
- Record
GHSA-mmcg-c68q-4p38- Weakness
- CWE-611
- Updated
- 2026-11-02
OSV No score
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
- Record
CVE-2013-1915- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1915 No score
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
- Record
DEBIAN-CVE-2013-1915- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10034-1 No score
apache2-mod_security2-2.9.0-5.6 on GA media
These are all security issues fixed in the apache2-mod_security2-2.9.0-5.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10034-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
modsecurity-apacheDebian:12 |
before 2.6.6-6 | 2.6.6-6 |
modsecurity-apacheDebian:13 |
before 2.6.6-6 | 2.6.6-6 |
modsecurity-apacheDebian:14 |
before 2.6.6-6 | 2.6.6-6 |
libapache-mod-securityDebian:6.0 |
before 2.5.12-1+squeeze2, plus listed versions 2.5.12-12.5.12-1+squeeze1 |
2.5.12-1+squeeze2 |
apache2-mod_security2openSUSE:Tumbleweed |
before 2.9.0-5.6 | 2.9.0-5.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1915 is a high vulnerability (CVSS 7.5) in Trustwave Modsecurity, published April 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.21%, the 91st percentile. Fixed in modsecurity-apache 2.6.6-6.
References
lists.opensuse.org/opensuse-updates/2013-08/msg00031.html
github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe
openwall.com/lists/oss-security/2013/04/03/7
securityfocus.com/bid/58810
lists.fedoraproject.org/pipermail/package-announce/2013-April/101911.html
Show 17 moreShow less
mandriva.com/security/advisories?name=MDVSA-2013:156
bugzilla.redhat.com/show_bug.cgi?id=947842
secunia.com/advisories/52977
debian.org/security/2013/dsa-2659
nvd.nist.gov/vuln/detail/CVE-2013-1915
security-tracker.debian.org/tracker/CVE-2013-1915
suse.com/security/cve/CVE-2009-5031