CVE-2023-38199

🗓️ 13 Jul 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 46 Views

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header

Reporter	Title	Published	Views	Family All 24
ATTACKERKB	CVE-2023-38199	13 Jul 202303:15	–	attackerkb
Circl	CVE-2023-38199	13 Jul 202307:45	–	circl
CNNVD	OWASP ModSecurity Core Rule Set 安全漏洞	13 Jul 202300:00	–	cnnvd
Cvelist	CVE-2023-38199	13 Jul 202300:00	–	cvelist
Debian	[SECURITY] [DLA 4488-1] modsecurity-crs security update	22 Feb 202610:03	–	debian
Debian CVE	CVE-2023-38199	13 Jul 202300:00	–	debiancve
Tenable Nessus	Debian dla-4488 : modsecurity-crs - security update	22 Feb 202600:00	–	nessus
Tenable Nessus	Siemens SINEC NMS < V2.0 SP1 Multiple Vulnerabilities	29 Feb 202400:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2023-38199	5 Mar 202500:00	–	nessus
EUVD	EUVD-2023-42021	3 Oct 202520:07	–	euvd