Vulnerability Description
coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Owasp | Coreruleset | <= 3.3.4 |
Related Weaknesses (CWE)
References
- https://github.com/coreruleset/coreruleset/issues/3191Issue TrackingPatch
- https://github.com/coreruleset/coreruleset/pull/3237Issue Tracking
- https://github.com/coreruleset/coreruleset/issues/3191Issue TrackingPatch
- https://github.com/coreruleset/coreruleset/pull/3237Issue Tracking
FAQ
What is CVE-2023-38199?
CVE-2023-38199 is a vulnerability with a CVSS score of 9.8 (CRITICAL). coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted paylo...
How severe is CVE-2023-38199?
CVE-2023-38199 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-38199?
Check the references section above for vendor advisories and patch information. Affected products include: Owasp Coreruleset.