PT-2022-25144 · Owasp+1 · Owasp Modsecurity Core Rule Set+1

Karel Knibbe + 1 · Published 2022-09-20 · Updated 2025-08-09 · CVE-2022-39957

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OWASP ModSecurity Core Rule Set (CRS) versions 3.0.x through 3.3.2

Description The issue concerns a response body bypass in the OWASP ModSecurity Core Rule Set (CRS). A client can exploit this by issuing an HTTP Accept header field with an optional charset parameter to receive the response in an encoded form. Depending on the charset, the response may not be decoded by the web application firewall, potentially allowing access to restricted resources without detection.

Recommendations For versions 3.0.x and 3.1.x, upgrade to version 3.2.2 or 3.3.3, respectively. For version 3.2.1, upgrade to version 3.2.2. For version 3.3.2, upgrade to version 3.3.3.

Fix

Protection Mechanism Failure

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-693

CWE-116

Related Identifiers

CVE-2022-39957

DLA-3293-1

DLA-4265-1

MGASA-2024-0070

OESA-2022-1970

Affected Products

Debian

Owasp Modsecurity Core Rule Set

References · 31

• https://advisories.mageia.org/MGASA-2024-0070.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/C4Q7DCCE37GT5ZBJOWP4NGUD4L3FAMDB · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-39957 · Security Note
• https://osv.dev/vulnerability/OESA-2022-1970 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39957 · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0070 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-39957 · Vendor Advisory
• https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39957 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ · Vendor Advisory
• https://security.gentoo.org/glsa/202305-25 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-39957 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3293-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4265-1 · Vendor Advisory