CVE-2023-38199

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might al...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2023-38199 modsecurity-crs Corrigé dans: 3.3.4-1~deb11u2
Ubuntu UBUNTU-CVE-2023-38199 modsecurity-crs

Références

advisory github.com
advisory nvd.nist.gov
patch github.com
report github.com