CVE-2021-35368
9.8
CRITICAL · CVSS 3.1 · EPSS 2.7% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.73% — more likely to be exploited than 86% of all CVEs |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2021-11-05 |
| Last modified | 2026-06-17 |
Affected (3)
| Vendor | Product |
|---|---|
| debian | debian linux |
| fedoraproject | fedora |
| owasp | owasp modsecurity core rule set |
References
- https://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass/
- https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MS5GMNYHFFIBWLJW7N3XAD24SLF3PFZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IVYUJOKHDEXFTM2CZMEESJ6TZSPVNSSZ/
- https://owasp.org/www-project-modsecurity-core-rule-set/
- https://portswigger.net/daily-swig/lessons-learned-how-a-severe-vulnerability-in-the-owasp-modsecurity-core-rule-set-sparked-much-needed-change
- https://portswigger.net/daily-swig/waf-bypass-severe-owasp-modsecurity-core-rule-set-bug-was-present-for-several-years
- https://security.gentoo.org/glsa/202305-25
- https://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass/
- https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MS5GMNYHFFIBWLJW7N3XAD24SLF3PFZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IVYUJOKHDEXFTM2CZMEESJ6TZSPVNSSZ/
- https://owasp.org/www-project-modsecurity-core-rule-set/
- https://portswigger.net/daily-swig/lessons-learned-how-a-severe-vulnerability-in-the-owasp-modsecurity-core-rule-set-sparked-much-needed-change
- https://portswigger.net/daily-swig/waf-bypass-severe-owasp-modsecurity-core-rule-set-bug-was-present-for-several-years
- https://security.gentoo.org/glsa/202305-25
→ the Explorer · watch your stack · NVD