CVE-2025-54571
Last modified
CVE-2025-54571 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. EPSS estimates a 0.26% chance of exploitation in the next 30 days.
Description
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of mod_security2. This issue is fixed in version 2.9.12.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Owasp | Modsecurity | >= 2.0.0, < 2.9.12 |
References
- https://github.com/owasp-modsecurity/ModSecurity/issues/2514Exploit, Issue Tracking
- https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cg44-9m43-3f9vExploit, Vendor Advisory
- https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-cg44-9m43-3f9vExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-54571?
How severe is CVE-2025-54571?
How do I fix CVE-2025-54571?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54563An Incorrect Access Control vulnerability was found in the A…7.5
- CVE-2025-54564uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate…7.8
- CVE-2025-54566hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration s…5.4
- CVE-2025-54567hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF…5.4
- CVE-2025-54568Akamai Rate Control alpha before 2025 allows attackers to se…3.7
- CVE-2025-54569In Malwarebytes Binisoft Windows Firewall Control before 6.1…4.5
- CVE-2025-54572The Ruby SAML library is for implementing the client side of…6.9
- CVE-2025-54573CVAT is an open source interactive video and image annotatio…6.5
- CVE-2025-54574Squid is a caching proxy for the Web. In versions 6.3 and be…9.8
- CVE-2025-54575ImageSharp is a 2D graphics library. In versions below 2.1.1…5.3
- CVE-2025-54576OAuth2-Proxy is an open-source tool that can act as either a…9.1
- CVE-2025-54581vproxy is an HTTP/HTTPS/SOCKS5 proxy server. In versions 2.3…7.5
Are you affected by CVE-2025-54571?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST