CVE-2012-4528

The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.

• http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.htmlMailing List, Third Party Advisory
• http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGESBroken Link
• http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?sortby=date&r1=2081&r2=2080&pathrev=2081Broken Link
• http://mod-security.svn.sourceforge.net/viewvc/mod-security?view=revision&sortby=date&revision=2081Broken Link
• http://seclists.org/fulldisclosure/2012/Oct/113Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/10/18/14Mailing List, Third Party Advisory
• https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20121017-0_mod_security_ruleset_bypass.txtThird Party Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093011.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-08/msg00020.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-08/msg00025.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-08/msg00031.htmlMailing List, Third Party Advisory
• http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/branches/2.7.x/CHANGESBroken Link
• http://mod-security.svn.sourceforge.net/viewvc/mod-security/m2/trunk/apache2/msc_multipart.c?sortby=date&r1=2081&r2=2080&pathrev=2081Broken Link
• http://mod-security.svn.sourceforge.net/viewvc/mod-security?view=revision&sortby=date&revision=2081Broken Link
• http://seclists.org/fulldisclosure/2012/Oct/113Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/10/18/14Mailing List, Third Party Advisory
• https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20121017-0_mod_security_ruleset_bypass.txtThird Party Advisory

Published

Dec 28, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4522The rb_get_path_check function in file.c in Ruby 1.9.3 befor…
• CVE-2012-4523radsecproxy before 1.6.1 does not properly verify certificat…
• CVE-2012-4524xlockmore before 5.43 'dclock' security bypass vulnerability7.5
• CVE-2012-4525piwigo has XSS in password.php6.1
• CVE-2012-4526piwigo has XSS in password.php (incomplete fix for CVE-2012-…6.1
• CVE-2012-4527Stack-based buffer overflow in mcrypt 2.6.8 and earlier allo…
• CVE-2012-4529The org.apache.catalina.connector.Response.encodeURL method …
• CVE-2012-4530The load_script function in fs/binfmt_script.c in the Linux …
• CVE-2012-4531Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x be…
• CVE-2012-4532Cross-site scripting (XSS) vulnerability in modules/mod_lang…
• CVE-2012-4533Cross-site scripting (XSS) vulnerability in the "extra" deta…
• CVE-2012-4534org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat…