NuytsTech Security

CVE-2023-38199

by ·

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not block multiple Content-Type headers, which might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion." This occurs when the web application relies on only the last Content-Type header.

Date published : 2023-07-12

https://github.com/coreruleset/coreruleset/issues/3191

https://github.com/coreruleset/coreruleset/pull/3237

Tags: