ModSecurity Core Rule Set vulnerabilities
4 known vulnerabilities in ModSecurity Core Rule Set from Owasp. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
ModSecurity Core Rule Set: Improper Encoding or Escaping of Output
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to whi
- 7.5 High severity
ModSecurity Core Rule Set: Improper Encoding or Escaping of Output
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this res
- 9.8 Critical severity
ModSecurity Core Rule Set: Improper Encoding or Escaping of Output
The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header
- 9.8 Critical severity
ModSecurity Core Rule Set: Incorrect Authorization
The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declar