CVE-2022-39956 Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header

🗓️ 20 Sep 2022 00:00:00Reported by GoogleType

osv🔗 osv.dev👁 40 Views

The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests using character encoding schemes in Content-Type or Content-Transfer-Encoding multipart MIME headers, leading to potential exploitation

Reporter	Title	Published	Views	Family All 74
Tenable Nessus	Amazon Linux 2 : mod_security (ALAS-2023-2098)	1 Jul 202300:00	–	nessus
Tenable Nessus	Amazon Linux AMI : mod24_security (ALAS-2023-1772)	3 Jul 202300:00	–	nessus
Tenable Nessus	Debian dla-3283 : libapache2-mod-security2 - security update	27 Jan 202300:00	–	nessus
Tenable Nessus	Debian dla-3293 : modsecurity-crs - security update	31 Jan 202300:00	–	nessus
Tenable Nessus	Debian dla-4265 : modsecurity-crs - security update	8 Aug 202500:00	–	nessus
Tenable Nessus	Fedora 37 : mod_security / mod_security_crs (2022-1fd73a5285)	15 Nov 202400:00	–	nessus
Tenable Nessus	Fedora 35 : mod_security / mod_security_crs (2022-85a85c84b3)	23 Dec 202200:00	–	nessus
Tenable Nessus	Fedora 36 : mod_security / mod_security_crs (2022-90708b46e3)	22 Dec 202200:00	–	nessus
Tenable Nessus	GLSA-202305-25 : OWASP ModSecurity Core Rule Set: Multiple Vulnerabilities	21 May 202300:00	–	nessus
Tenable Nessus	RHEL 7 : mod_security_crs (Unpatched Vulnerability)	11 May 202400:00	–	nessus

Source	Link
coreruleset	www.coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/
lists	www.lists.debian.org/debian-lts-announce/2025/08/msg00004.html
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39956.json
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-39956
security	www.security.gentoo.org/glsa/202305-25
lists	www.lists.debian.org/debian-lts-announce/2023/01/msg00033.html