Web Application Firewall Rule Bypass in Jetpack WAF Runtime

Jetpack's bundled Web Application Firewall did not clear its cached MATCHED_VAR/MATCHED_VARS metadata between rule evaluations, so a rule referencing those targets kept receiving a previous rule's stale match data. A remote attacker could craft a request that makes later firewall rules evaluate the wrong content, masking malicious input and... Weiterlesen