CVE-2018-16384: Owasp Modsecurity Core Rule Set

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.

Affected products

• Owasp Owasp Modsecurity Core Rule Set: up to and including 3.0.2; version 3.1.0 only

Published 2018-09-03. Last modified 2026-06-17.