VDB
CISA-2022-39957
CISA-2022-39957
PUBLISHED
CVSS 7.3 HIGH
Reported by NCSC.ch · Published September 20, 2022
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.
Risk Scores
CVSS 3.1
7.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OWASP | ModSecurity Core Rule Set | 3.0.x, 3.1.x, unspecified |
| OWASP | ModSecurity Core Rule Set | 3.0.x, 3.1.x, unspecified |
Timeline
- Sep 20, 2022 CVE Published
- Nov 3, 2025 CVE Updated
- Apr 26, 2026 Security Advisory
References
- FEDORA-2022-90708b46e3 vendor-advisory
- FEDORA-2022-85a85c84b3 vendor-advisory
- FEDORA-2022-1fd73a5285 vendor-advisory
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3293-1] modsecurity-crs security update mailing-list
- GLSA-202305-25 vendor-advisory
- https://lists.debian.org/debian-lts-announce/2025/08/msg00004.html url