PT-2022-25143 · Owasp+1 · Owasp Modsecurity Core Rule Set+1

Jan Gora + 1 · Published 2022-09-20 · Updated 2025-08-09 · CVE-2022-39956

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OWASP ModSecurity Core Rule Set (CRS) versions 3.0.x through 3.3.2

Description The issue concerns a partial rule set bypass for HTTP multipart requests. This occurs when a payload uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields. As a result, the web application firewall engine and the rule set will not decode and inspect the payload, allowing it to bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited.

Recommendations For versions 3.0.x and 3.1.x, upgrade to version 3.2.2 or 3.3.3, respectively. For version 3.2.1, upgrade to version 3.2.2. For version 3.3.2, upgrade to version 3.3.3. As a general mitigation measure, install the latest ModSecurity version (v2.9.6 / v3.0.8).

Fix

Incorrect Authorization

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-863

CWE-116

Related Identifiers

CVE-2022-39956

DLA-3283-1

DLA-3293-1

DLA-4265-1

MGASA-2024-0070

OESA-2022-1964

OESA-2025-1559

OESA-2025-1560

OESA-2025-1561

Affected Products

Debian

Owasp Modsecurity Core Rule Set

References · 41

• https://nvd.nist.gov/vuln/detail/CVE-2022-39955 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-47947 · Security Note
• https://advisories.mageia.org/MGASA-2024-0070.html · Security Note
• https://ubuntu.com/security/CVE-2022-39956 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39956 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1561 · Vendor Advisory
• https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39956 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4265-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6MS5GMNYHFFIBWLJW7N3XAD24SLF3PFZ · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-39956 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3283-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39956 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1964 · Vendor Advisory