CVE-2023-40586 — HIGH (7.5)

Vulnerability Description

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Coraza	Coraza	3.0.0

Related Weaknesses (CWE)

CWE-400

References

https://github.com/corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcadPatch
https://github.com/corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6hMitigationVendor Advisory
https://github.com/corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcadPatch
https://github.com/corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6hMitigationVendor Advisory

FAQ

What is CVE-2023-40586?

CVE-2023-40586 is a vulnerability with a CVSS score of 7.5 (HIGH). OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from atta...

How severe is CVE-2023-40586?

CVE-2023-40586 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-40586?

Check the references section above for vendor advisories and patch information. Affected products include: Coraza Coraza.