Description (CNA)
Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| corazawaf / coraza | affected 3.0.0 before 3.8.1; unaffected 3.8.1 |
CWE
CWE-20