CVE-2022-39958

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-39958
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-39958.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-39958
Downstream
Published
2022-09-20T00:00:00Z
Modified
2026-07-01T11:54:21.466183525Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range
Details

The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be exfiltrated from the backend, despite being protected by a web application firewall that uses CRS. Short subsections of a restricted resource may bypass pattern matching techniques and allow undetected access. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively and to configure a CRS paranoia level of 3 or higher.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "3.0.x"
                },
                {
                    "last_affected": "3.1.x"
                },
                {
                    "last_affected": "3.2.1"
                },
                {
                    "last_affected": "3.3.2"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39958.json",
    "cna_assigner": "NCSC.ch",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/coreruleset/coreruleset

Affected ranges

Type
GIT
Repo
https://github.com/coreruleset/coreruleset
Events
Introduced
90596883aa103599e2aa046181c5bb79b0b6b19c
Fixed
87979aacb81fae13f993d0b86faa216788e909cc
Introduced
7776fe23f127fd2315bad0e400bdceb2cabb97dc
Fixed
279171c5e3199f36b07dbf567f49fc57ab5d065d
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.2.2"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "fixed": "3.3.3"
        }
    ],
    "cpe": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:*:*:*:*:*:*:*:*"
}

Affected versions

v3.*
v3.3.0
v3.3.1-rc1
v3.3.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-39958.json"