CVE-2022-39955

 

Published at: - 20-09-2022 09:15

Last modified: - 30-01-2023 10:15

Total changes: - 7

Description

The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type "charset" names and therefore bypassing the configurable CRS Content-Type header "charset" allow list. An encoded payload can bypass CRS detection this way and may then be decoded by the backend. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/
• FEDORA-2022-90708b46e3-Mailing List, Third Party Advisory
• FEDORA-2022-85a85c84b3-Mailing List, Third Party Advisory
• FEDORA-2022-1fd73a5285-Mailing List, Third Party Advisory
• [debian-lts-announce] 20230130 [SECURITY] [DLA 3293-1] modsecurity-crs security update-

 

Keywords

NVD

 

CVE-2022-39955

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures