# CVE-2023-38199: CVE-2023-38199

- Exploited (CISA KEV): no
- Published: 2023-07-13
- CVSS: not scored
- EPSS: 0.7% (55th percentile)

coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | Rule published | 2023-07-18 | 5 |

### OWASP CRS

- 2023-07-18 · new · rule 920620
  > Backport fix for CVE-2023-38199 from CRS v4 via new rule 920620 (Andrea Menin, Felipe Zipitría)
  Source: https://github.com/coreruleset/coreruleset/blob/main/CHANGES.md
- 2024-02-14 · new · rule 920620
  > feat: add new rule to explicitly detect multiple Content-Type abuse (CVE-2023-38199) (920620 PL1) (Andrea Menin) [#3237]
  Source: https://github.com/coreruleset/coreruleset/blob/main/CHANGES.md

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2023-38199 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2023-38199