ModSecurity response body inspection bypass
The website firewall skips checking some responses, so sensitive information can leak.
Summary
A case-sensitive Content-Type comparison in the ModSecurity web application firewall engine makes it skip response body inspection. An unauthenticated requester can receive content that should be blocked, including sensitive error or debug data.
Affected when
- ModSecurity 3.0.0 up to 3.0.17
- SecResponseBodyMimeType configured
What to do
Update to ModSecurity 3.0.17.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen