QwikSec

Security Database

CVE

CWE

Training

CVE-2022-48279

Published: Jan 20, 2023

Modified: Apr 3, 2025

PUBLISHED

Description

In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.6

https://github.com/SpiderLabs/ModSecurity/pull/2797

https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.8

https://github.com/SpiderLabs/ModSecurity/pull/2795

https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/

[debian-lts-announce] 20230126 [SECURITY] [DLA 3283-1] modsecurity-apache security update

mailing-list

FEDORA-2023-8aa264d5c5

vendor-advisory

FEDORA-2023-09f0496e60

vendor-advisory

FEDORA-2023-bc61f7a145

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.