CVE-2022-48279

In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.

• CWE-436
• CWE-436

• https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/Not Applicable
• https://github.com/SpiderLabs/ModSecurity/pull/2795Patch, Third Party Advisory
• https://github.com/SpiderLabs/ModSecurity/pull/2797Patch, Third Party Advisory
• https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.6Release Notes, Third Party Advisory
• https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.8Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/52TGCZCOHYBDCVWJYNN2PS4QLOHCXWTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYRTXTOQQI6SB2TLI5QXU76DURSLS4XI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCH6JM4I4MD4YABYFHSBDDOUFDGIFJKL/
• https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/Not Applicable
• https://github.com/SpiderLabs/ModSecurity/pull/2795Patch, Third Party Advisory
• https://github.com/SpiderLabs/ModSecurity/pull/2797Patch, Third Party Advisory
• https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.6Release Notes, Third Party Advisory
• https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.8Release Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00023.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/52TGCZCOHYBDCVWJYNN2PS4QLOHCXWTQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYRTXTOQQI6SB2TLI5QXU76DURSLS4XI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCH6JM4I4MD4YABYFHSBDDOUFDGIFJKL/

Published

Jan 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-48258In Eternal Terminal 6.2.1, etserver and etclient have world-…5.3
• CVE-2022-48259There is a system command injection vulnerability in BiSheng…9.8
• CVE-2022-4826The Simple Tooltips WordPress plugin before 2.1.4 does not v…5.4
• CVE-2022-48260There is a buffer overflow vulnerability in BiSheng-WNM FW 3…7.5
• CVE-2022-48261There is a misinterpretation of input vulnerability in BiShe…7.5
• CVE-2022-4827The WP Tiles WordPress plugin through 1.1.2 does not validat…5.4
• CVE-2022-4828The Bold Timeline Lite WordPress plugin before 1.1.5 does no…5.4
• CVE-2022-48281processCropSelections in tools/tiffcrop.c in LibTIFF through…5.5
• CVE-2022-48282Under very specific circumstances (see Required configuratio…7.2
• CVE-2022-48283A piece of Huawei whole-home intelligence software has an In…9.8
• CVE-2022-48284A piece of Huawei whole-home intelligence software has an In…9.8
• CVE-2022-48285loadAsync in JSZip before 3.8.0 allows Directory Traversal v…7.3