CVE-2022-39958

 

Published at: - 20-09-2022 09:15

Last modified: - 30-01-2023 10:15

Total changes: - 7

Description

The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be exfiltrated from the backend, despite being protected by a web application firewall that uses CRS. Short subsections of a restricted resource may bypass pattern matching techniques and allow undetected access. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively and to configure a CRS paranoia level of 3 or higher.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

 

Verification logic

 

Reference

• https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/
• FEDORA-2022-90708b46e3-Mailing List, Third Party Advisory
• FEDORA-2022-85a85c84b3-Mailing List, Third Party Advisory
• FEDORA-2022-1fd73a5285-Mailing List, Third Party Advisory
• [debian-lts-announce] 20230130 [SECURITY] [DLA 3293-1] modsecurity-crs security update-

 

Keywords

NVD

 

CVE-2022-39958

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures