Log in Start free

Vulnerability · Published Aug 5, 2025 · Assigned by GitHub_M

CVE-2025-54571ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure

Medium 6.9

In plain English

A medium-severity security flaw in ModSecurity from owasp-modsecurity. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12modsecurity-apache2.9.7-1+deb12u2DEBIAN-CVE-2025-54571
Debian:13modsecurity-apache2.9.11-1+deb13u1DEBIAN-CVE-2025-54571
Debian:14modsecurity-apache2.9.12-2DEBIAN-CVE-2025-54571
Ubuntu:22.04:LTSmodsecurityno fix listedUBUNTU-CVE-2025-54571
Ubuntu:24.04:LTSmodsecurityno fix listedUBUNTU-CVE-2025-54571
Ubuntu:25.10modsecurityno fix listedUBUNTU-CVE-2025-54571
Ubuntu:26.04:LTSmodsecurityno fix listedUBUNTU-CVE-2025-54571
Ubuntu:26.10modsecurityno fix listedUBUNTU-CVE-2025-54571

Affected products (as reported)

VendorProductVersions
owasp-modsecurity ModSecurity < 2.9.12

Weakness: CWE-252 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References