On this page
Atomicorp WAF Rule 330039
Rule Summary
- Rule ID: 330039
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Suspicious Unusual User Agent (libwww-perl). Disable this rule if you use libwww-perl.
- Observed CWEs: CWE-306 (1)
- Revision: 4
- Rule severity: Critical (2)
- Phase: 2 (request body)
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule is triggerd if the user agent used to connect to the system is libwww-perl. Some PCI-DSS scanners will report a vulnerability if the system does not block all requests from this client.
False Positives
This client may already be used by some legitimate scripts and therefore this may not be an attack. If you use libwww-perl you must disable this rule.
False positives are not really possible with this rule. The rule simply alerts if the client reports itself as libwww-perl. If this is in error, please check your application.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2017-18001 | Trustwave SWG 11.8.0.27 - SSH Unauthorized Access | secure web gateway | 9.8 (v3.0) | Critical |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.
| CWE | Related Published CVEs |
|---|---|
| CWE-306 | CVE-2017-18001 |
Documentation Source
- Original wiki page: WAF 330039
- Source revision: 1069
- Source revision date: 2010-10-29