Unrated severityNVD Advisory· Published Mar 8, 2007· Updated Jun 16, 2026
CVE-2007-1359
CVE-2007-1359
Description
Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still processed as normal data by some HTTP parsers including PHP 5.2.0, and possibly parsers in Perl, and Python.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9cpe:2.3:a:mod_security:mod_security:1.7:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:mod_security:mod_security:1.7:*:*:*:*:*:*:*
- cpe:2.3:a:mod_security:mod_security:1.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:mod_security:mod_security:1.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:mod_security:mod_security:1.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:mod_security:mod_security:1.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:mod_security:mod_security:1.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:mod_security:mod_security:2.1:*:*:*:*:*:*:*
- Range: <=2.1.0
Patches
Vulnerability mechanics
References
15- www.php-security.org/MOPB/BONUS-12-2007.htmlnvdExploitVendor Advisory
- secunia.com/advisories/24373nvdVendor Advisory
- www.securityfocus.com/bid/22831nvdVendor Advisory
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jspnvd
- secunia.com/advisories/25316nvd
- secunia.com/advisories/31087nvd
- secunia.com/advisories/31113nvd
- www.gentoo.org/security/en/glsa/glsa-200705-17.xmlnvd
- www.modsecurity.org/blog/archives/2007/03/modsecurity_asc.htmlnvd
- www.oracle.com/technetwork/topics/security/cpujul2008-090335.htmlnvd
- www.osvdb.org/32778nvd
- www.vupen.com/english/advisories/2007/0868nvd
- www.vupen.com/english/advisories/2008/2109/referencesnvd
- www.vupen.com/english/advisories/2008/2115nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/32872nvd
News mentions
0No linked articles in our index yet.