Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-39957

The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.

Published

2022-09-20T07:15:12.353

Last Modified

2024-11-21T07:18:33.830

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.3 (HIGH)

Weaknesses
  • Type: Secondary
    CWE-693
  • Type: Primary
    CWE-116
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application owasp owasp_modsecurity_core_rule_set < 3.2.2 Yes
Application owasp owasp_modsecurity_core_rule_set < 3.3.3 Yes
Operating System fedoraproject fedora 35 Yes
Operating System fedoraproject fedora 36 Yes
Operating System fedoraproject fedora 37 Yes
Operating System debian debian_linux 10.0 Yes
References