CVE-2022-39957

Name of the Vulnerable Software and Affected Versions OWASP ModSecurity Core Rule Set (CRS) versions 3.0.x through 3.3.2

Description The issue concerns a response body bypass in the OWASP ModSecurity Core Rule Set (CRS). A client can exploit this by issuing an HTTP Accept header field with an optional charset parameter to receive the response in an encoded form. Depending on the charset, the response may not be decoded by the web application firewall, potentially allowing access to restricted resources without detection.

Recommendations For versions 3.0.x and 3.1.x, upgrade to version 3.2.2 or 3.3.3, respectively. For version 3.2.1, upgrade to version 3.2.2. For version 3.3.2, upgrade to version 3.3.3.