CVE-2019-13464: An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2

This week

HIGH 7.5REMOTEDOWNGRADE

CVE-2019-13464 is a high-severity flaw (CVSS 7.5) affecting owasp modsecurity core rule set. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.

Why this priority

High severity
Public exploit reference
Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.5% (top 26%)
CISA exploited list	No
Weakness	CWE-434
Published	2019-07-09
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: modsecurity

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2019-07-09 19:15 UTCPublished CVE record published
2026-06-17 02:16 UTCUpdated Record last modified

modsecurity owasp modsecurity core rule set DOWNGRADE

Affected: 3.0.2

Fixed in: no fixed release known

Safe to downgrade to: a release before 3.0.2

1. Check installed version

apt-cache policy owasp-modsecurity-core-rule-set || rpm -q owasp-modsecurity-core-rule-set || owasp-modsecurity-core-rule-set --version

2. No fixed release: DOWNGRADE to a release before 3.0.2 (Debian / Ubuntu)

apt-cache madison owasp-modsecurity-core-rule-set sudo apt install owasp-modsecurity-core-rule-set=<VERSION_BEFORE_3.0.2> sudo apt-mark hold owasp-modsecurity-core-rule-set

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list owasp-modsecurity-core-rule-set sudo dnf downgrade owasp-modsecurity-core-rule-set-<VERSION_BEFORE_3.0.2> sudo dnf versionlock add owasp-modsecurity-core-rule-set

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2019-13464?

owasp modsecurity core rule set: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2019-13464 being exploited?

CVE-2019-13464 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2019-13464 affect?

CVE-2019-13464 affects owasp modsecurity core rule set. Severity is high (CVSS 7.5). An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where d

How urgent is CVE-2019-13464?

Priority 55/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action

Software pages

PHP vulnerabilities

Related CVEs

CVE-2026-33691 MEDIUM 6.8 UPGRADE The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web applicati
CVE-2026-21876 CRITICAL 9.3 UPGRADE The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web applicati
CVE-2022-39958 HIGH 7.5 UPGRADE MITIGATE The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate sma
CVE-2022-39957 HIGH 7.3 UPGRADE MITIGATE The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass
CVE-2022-39956 HIGH 7.3 UPGRADE MITIGATE The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests

References

← Back to latest CVEs