On this page

Atomicorp WAF Rule 390704

Rule Summary

  • Rule ID: 390704
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Possible Encoding Abuse Attack Attempt
  • Observed CWEs: CWE-20 (1), CWE-22 (1), CWE-74 (2), CWE-78 (2), CWE-79 (4), CWE-89 (9), CWE-200 (4), CWE-295 (2), CWE-306 (1), CWE-352 (3), CWE-611 (1), CWE-640 (1), CWE-798 (1)
  • Revision: 1
  • Rule severity: Notice (5)
  • Phase: 2 (request body)
  • Request surfaces: Request headers
  • Rule action: deny
  • HTTP status: 400
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Possible Encoding Abuse Attack Attempt” in the request headers. It evaluates during the request body phase and denies matching traffic with HTTP status 400.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

CVEVulnerabilityProductCVSSSeverity
CVE-2010-2861Adobe ColdFusion - Directory Traversalcoldfusion9.8 (v3.1)Critical
CVE-2012-5686ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Resetzpanel9.8 (v3.1)Critical
CVE-2016-2386SAP NetWeaver J2EE Engine 7.40 - SQL Injectionnetweaver application server java9.8 (v3.1)Critical
CVE-2017-9811Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilitiesanti-virus for linux server9.8 (v3.0)Critical
CVE-2018-6220Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6223Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6228Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2018-6229Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway9.8 (v3.0)Critical
CVE-2022-31181PrestaShop - SQL Injection to Eval Injectionprestashop9.8 (v3.1)Critical
CVE-2017-9810Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilitiesanti-virus for linux server8.8 (v3.0)High
CVE-2018-6224Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway8.8 (v3.0)High
CVE-2018-6221Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway8.1 (v3.0)High
CVE-2018-6222Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway7.8 (v3.0)High
CVE-2016-3473Oracle BI Publisher 11.1.1.6.0/11.1.1.7.0/11.1.1.9.0/12.2.1.0.0 - XML External Entity Injectionbusiness intelligence publisher7.7 (v3.0)High
CVE-2012-5685ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Resetzpanel7.5 (v2.0)High
CVE-2013-5694Opsview pre 4.4.1 - Blind SQL Injectionopsview7.5 (v2.0)High
CVE-2015-1428Sefrengo CMS 1.6.1 - Multiple SQL Injectionssefrengo7.5 (v2.0)High
CVE-2017-9812Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilitiesanti-virus for linux server7.5 (v3.0)High
CVE-2018-7448CMS Made Simple 2.1.6 - Remote Code Executioncms made simple7.5 (v3.0)High
CVE-2024-0566Smart Manager 8.27.0 - Post-Authenticated SQL Injectionsmart manager7.2 (v3.1)High
CVE-2012-5683ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Resetzpanel6.8 (v2.0)Medium
CVE-2018-6230Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway6.8 (v3.0)Medium
CVE-2018-6219Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway6.5 (v3.0)Medium
CVE-2017-9813Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilitiesanti-virus for linux server6.1 (v3.0)Medium
CVE-2018-6226Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway5.4 (v3.0)Medium
CVE-2018-6227Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway5.4 (v3.0)Medium
CVE-2016-1910SAP NetWeaver J2EE Engine 7.40 - SQL Injectionnetweaver5.3 (v3.0)Medium
CVE-2016-2388SAP NetWeaver J2EE Engine 7.40 - SQL Injectionnetweaver application server java5.3 (v3.1)Medium
CVE-2012-5684ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Resetzpanel4.3 (v2.0)Medium
CVE-2018-6225Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilitiesemail encryption gateway4.3 (v3.0)Medium

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

CWERelated Published CVEs
CWE-20CVE-2017-9811
CWE-22CVE-2010-2861
CWE-74CVE-2018-6220 , CVE-2022-31181
CWE-78CVE-2018-6222 , CVE-2018-7448
CWE-79CVE-2017-9813 , CVE-2018-6226 , CVE-2018-6227 , CVE-2012-5684
CWE-89CVE-2016-2386 , CVE-2018-6228 , CVE-2018-6229 , CVE-2022-31181 , CVE-2012-5685 , CVE-2013-5694 , CVE-2015-1428 , CVE-2024-0566 , CVE-2018-6230
CWE-200CVE-2016-3473 , CVE-2017-9812 , CVE-2016-1910 , CVE-2016-2388
CWE-295CVE-2018-6221 , CVE-2018-6219
CWE-306CVE-2018-6223
CWE-352CVE-2017-9810 , CVE-2018-6224 , CVE-2012-5683
CWE-611CVE-2018-6225
CWE-640CVE-2012-5686
CWE-798CVE-2012-5686