CVE-2011-3140 Security feature bypass in n/a
Remote attackers can bypass intrusion prevention by splitting dangerous parameters, allowing SQL injection on protected web servers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-3140?
CVE-2011-3140 is a medium-severity vulnerability in n/a, published on 15 Aug 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Web Application Firewall, as used on the G400 IPS-G400-IB-1 and GX4004 IPS-GX4004-IB-2 appliances with update 31.030, does not properly handle query strings with multiple instances of the same parameter, which allows remote attackers to bypass intended intrusion prevention by dividing a dangerous parameter value into substrings, as demonstrated by a SQL statement that is split across multiple iid parameters and then sent to a .aspx file on an IIS web server.
Weakness: CWE-264
Which versions are affected by CVE-2011-3140?
It affects 3 products.
Products include Ibm G400 Ips-G400-Ib-1 Appliance, Ibm Gx4004 Ips-Gx4004-Ib-2 Appliance, Ibm Web Application Firewall.
How do I fix CVE-2011-3140?
No fix has been published for CVE-2011-3140 yet. Limit exposure of the affected software until one is available.
Is CVE-2011-3140 being exploited?
There is no known exploitation of CVE-2011-3140 in the wild and no public exploit code.
Sources
Also known as GHSA-4ffw-q78r-2442.