Input validation error in ModSecurity - CVE-2022-48279

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU72085

Input validation error in ModSecurity - CVE-2022-48279

Published: February 9, 2023


Vulnerability identifier: #VU72085
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-48279
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input when parsing HTTP multipart requests. A remote attacker can send specially crafted input to the application and bypass the Web Application Firewall.


Affected software

ModSecurity
Amazon Linux AMI
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
openEuler
Fedora
libapache2-modsecurity (Ubuntu package)
libapache2-mod-security2 (Ubuntu package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
mod_security
mod24_security
apache2-mod_security2-debugsource
apache2-mod_security2
apache2-mod_security2-debuginfo
jbcs-httpd24-mod_security (Red Hat package)
mod_security-debugsource
mod_security-debuginfo
jbcs-httpd24-curl (Red Hat package)
JBoss Core Services
HPE OneView

How to mitigate CVE-2022-48279

Install updates from vendor's website.

ModSecurity - addressed in versions 2.9.6, 3.0.8
libapache2-modsecurity (Ubuntu package) - update to Ubuntu Pro
libapache2-mod-security2 (Ubuntu package) - addressed in versions Ubuntu Pro, 2.9.3-1ubuntu0.1
jbcs-httpd24-mod_proxy_cluster (Red Hat package) - addressed in versions 1.3.19-4.el7jbcs, 1.3.19-4.el8jbcs
jbcs-httpd24-apr-util (Red Hat package) - addressed in versions 1.6.1-102.el7jbcs, 1.6.1-102.el8jbcs
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.7.0-8.el7jbcs, 1.7.0-8.el8jbcs
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.19-28.el7jbcs, 1.15.19-28.el8jbcs
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.4.0-25.el7jbcs, 2.4.0-25.el8jbcs
JBoss Core Services - update to 2.4.57
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.57-5.el7jbcs, 2.4.57-5.el8jbcs
mod_security - update to 2.8.0-5.28
mod24_security - update to 2.8.0-5.28
apache2-mod_security2-debugsource - addressed in versions 2.8.0-7.6.1, 2.9.2-150000.3.6.1, 2.9.4-150400.3.3.1
apache2-mod_security2 - addressed in versions 2.8.0-7.6.1, 2.9.2-150000.3.6.1, 2.9.4-150400.3.3.1
apache2-mod_security2-debuginfo - addressed in versions 2.8.0-7.6.1, 2.9.2-150000.3.6.1, 2.9.4-150400.3.3.1
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.3-29.el7jbcs, 2.9.3-29.el8jbcs
mod_security-debugsource - addressed in versions 2.9.5-2, 2.9.5-3, 2.9.5-9
mod_security-debuginfo - addressed in versions 2.9.5-2, 2.9.5-3, 2.9.5-9
mod_security - addressed in versions 2.9.5-2, 2.9.5-3, 2.9.5-9
mod_security - addressed in versions 2.9.7-1.fc36, 2.9.7-1.fc37, 2.9.7-1.fc38
jbcs-httpd24-curl (Red Hat package) - addressed in versions 8.2.1-1.el7jbcs, 8.2.1-1.el8jbcs
HPE OneView - update to 8.90.00

External References

Related Security Bulletins