Skip to content
OpenAdvisories
High WID-SEC-2022-1653 4 CVEs

Trustwave ModSecurity: Mehrere Schwachstellen

Published Oct 9, 2022 · Updated Aug 10, 2025 · Revision 8 · de-DE

Vendor: amazon Vendor: Debian Vendor: gentoo Product: Linux Product: Linux Product: Linux 2

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Trustwave ModSecurity ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.

Product

ModSecurity ist eine Open Source Web Application Firewall, die für verschiedene Webserver verfügbar ist.

Vulnerabilities 4

  • High 7.5
    CVE-2022-39958

    Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range

    The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to wh…

    OWASP ModSecurity Core Rule Set modsecurity-crs modsecurity-crs Debian Ubuntu
  • High 7.3
    CVE-2022-39955

    Partial rule set bypass in OWASP ModSecurity Core Rule Set by submitting a specially crafted HTTP Content-Type header

    The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by decla…

    OWASP ModSecurity Core Rule Set modsecurity-crs modsecurity-crs Debian Ubuntu
  • High 7.3
    CVE-2022-39956

    Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header

    The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header…

    OWASP ModSecurity Core Rule Set modsecurity-crs modsecurity-crs Debian Ubuntu
  • High 7.3
    CVE-2022-39957

    Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header

    The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this re…

    OWASP ModSecurity Core Rule Set modsecurity-crs modsecurity-crs Debian Ubuntu

Revision history

  1. #8

    Neue Updates von Debian aufgenommen

  2. #7

    Neue Updates von Amazon aufgenommen

  3. #6

    Neue Updates von Amazon aufgenommen

  4. #5

    Neue Updates von Amazon aufgenommen

  5. #4

    Neue Updates von Gentoo aufgenommen

  6. #3

    Neue Updates von Debian aufgenommen

  7. #2

    Neue Updates von Debian aufgenommen

  8. #1

    Initiale Fassung

References