CVE-2023-38199 Information

Description

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not block multiple Content-Type headers which might allow attackers to bypass a WAF with a crafted payload aka \Content-Type confusion.\ This occurs when the web application relies on only the last Content-Type header.

Reference

https://github.com/coreruleset/coreruleset/issues/3191 https://github.com/coreruleset/coreruleset/pull/3237