CVE-2022-39957

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-39957
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-39957.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-39957
Downstream
Published
2022-09-20T00:00:00Z
Modified
2026-05-07T04:16:20.801040Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header
Details

The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39957.json",
    "cna_assigner": "NCSC.ch",
    "cwe_ids": [
        "CWE-693"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "3.0.x"
                },
                {
                    "last_affected": "3.1.x"
                },
                {
                    "last_affected": "3.2.1"
                },
                {
                    "last_affected": "3.3.2"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/coreruleset/coreruleset

Affected ranges

Type
GIT
Repo
https://github.com/coreruleset/coreruleset
Events
Introduced
90596883aa103599e2aa046181c5bb79b0b6b19c
Fixed
87979aacb81fae13f993d0b86faa216788e909cc
Introduced
7776fe23f127fd2315bad0e400bdceb2cabb97dc
Fixed
279171c5e3199f36b07dbf567f49fc57ab5d065d
Database specific 
{
    "cpe": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.2.2"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.3"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

v3.*
v3.3.0
v3.3.1-rc1
v3.3.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-39957.json"