CVE-2013-1915: ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet se...

Security readout for executives and security teams

A vulnerable ModSecurity installation can be tricked through crafted XML into resolving external entities. For organizations using ModSecurity as a web application firewall, this can expose local files, reach internal web services, or consume CPU and memory. Sources identify versions before 2.7.3 and downstream package advisories, but do not show active exploitation. Exposure is most likely where ModSecurity before 2.7.3 is deployed in front of applications receiving XML request bodies. Packaged Linux distributions may also be exposed if their ModSecurity package predates the cited 2013 security updates. Prioritize remediation for internet-facing systems using old ModSecurity packages, especially where XML traffic is accepted. The issue is old and patches exist, but the impact can include sensitive file disclosure, internal service reachability, and service disruption. Mitigation focus: Upgrade ModSecurity to version 2.7.3 or a vendor-patched package.; Apply relevant Linux distribution security updates where ModSecurity came from system packages.; Review vendor guidance for any configuration mitigations not shown in these sources..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.