Description
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | modsecurity-apache | 2.6.6-6 | — |
| Debian 13 | modsecurity-apache | 2.6.6-6 | — |
| Debian 12 | modsecurity-apache | 2.6.6-6 | — |
| Debian 6.0 | libapache-mod-security | 2.5.12-1+squeeze2 | DSA-2659-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_security2 | 2.9.0-5.6 | openSUSE-SU-2024:10034-1 |
Advisories 2
- DSA-2659-1 libapache-mod-security - XML external entity processing vulnerability Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10034-1 apache2-mod_security2-2.9.0-5.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- openSUSE-SU-2013:1342 vendor-advisory
- https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe
- openSUSE-SU-2013:1331 vendor-advisory
- [oss-security] 20130403 Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks mailing-list
- 58810 vdb-entry
- FEDORA-2013-4831 vendor-advisory
- MDVSA-2013:156 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=947842
- FEDORA-2013-4834 vendor-advisory
- https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES
- FEDORA-2013-4908 vendor-advisory
- 52977 third-party-advisory
- 52847 third-party-advisory
- DSA-2659 vendor-advisory
- openSUSE-SU-2013:1336 vendor-advisory