---
title: Historical (2024) · Cloudflare Web Application Firewall (WAF) docs
description: Changes to WAF managed rulesets done in 2024.
lastUpdated: 2025-02-18T19:39:49.000Z
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/waf/change-log/historical-2024/
  md: https://developers.cloudflare.com/waf/change-log/historical-2024/index.md
---

| Ruleset | Rule ID | Legacy Rule ID | Description | Change Date | Old Action | New Action |
| - | - | - | - | - | - | - |
| Cloudflare Specials | fc7338307e484b9f8d460aca6bc398e9 | 100675 | Adobe ColdFusion - Auth Bypass - CVE:CVE-2023-38205 | 2024-10-21 | Log | Block |
| Cloudflare Specials | 9226fa56d43b4d9a81e36575710cc526 | 100676 | Palo Alto Networks - Auth Bypass - CVE:CVE-2024-5910 | 2024-10-21 | Log | Block |
| Cloudflare Specials | 97e5190080874e828986516604f7d36a | 100677 | SolarWinds - Auth Bypass - CVE:CVE-2024-28987 | 2024-10-21 | Log | Block |
| Cloudflare Specials | 90658d0d48b34882830d8da32e49c1d8 | 100673 | GoAnywhere - Remote Code Execution - CVE:CVE-2023-0669 | 2024-10-14 | Log | Block |
| Cloudflare Specials | 81b9bdf1270c4643a7b0e051168ef44c | 100669 | Apache HugeGraph-Server - Remote Code Execution - CVE:CVE-2024-27348 | 2024-10-07 | Log | Block |
| Cloudflare Specials | 919ecfe1bf1a41fabe47050191e9ba51 | 100672 | Ivanti Virtual Traffic Manager - Auth Bypass - CVE:CVE-2024-7593 | 2024-10-07 | Log | Block |
| Cloudflare Specials | bf8594562fc745578488e74aeb60e909 | 100670 | Junos - Remote Code Execution - CVE:CVE-2023-36844 | 2024-10-07 | Log | Block |
| Cloudflare Specials | a14873b9a10143c5a61369dc84938aa0 | 100671 | Microsoft SQL Server - Remote Code Execution - CVE:CVE-2020-0618 | 2024-10-07 | Log | Block |
| Cloudflare Specials | 6da28a8f5a734bb7a89f55572f26b3a7 | 100581 | Joomla - Information Disclosure - CVE:CVE-2023-23752 | 2024-10-07 | Log | Block |
| Cloudflare Specials | 05688219275547a9bc6e9d9d11020996 | 100668 | Progress Software WhatsUp Gold - Information Disclosure - CVE:CVE-2024-6670 | 2024-10-01 | Log | Block |
| Cloudflare Specials | 7b822fd1f5814e17888ded658480ea8f | N/A | Anomaly:Body - Large 2 | 2024-09-16 | N/A | Disabled |
| Cloudflare Specials | bbf685d70ddc467e8efb0ed0a24f08b7 | 100526 | VMware vCenter - CVE:CVE-2022-22954, CVE:CVE-2022-22948 | 2024-09-03 | N/A | Block |
| Cloudflare Specials | 86b480c7ed6b466e90921b631a48569a | 100667 | Authentik - Auth Bypass - CVE:CVE-2024-42490 | Emergency, 2024-08-20 | N/A | Block |
| Cloudflare Specials | 7ff77f19b2ec4f1dab9f031ef3f42616 | 100666 | Apache OFBiz - Remote Code Execution - CVE:CVE-2024-32113 | 2024-08-19 | Log | Block |
| Cloudflare Specials | e960ac54d6e841cebcfe89d571eefd6f | 100665 | Zoho ManageEngine - Remote Code Execution - CVE:CVE-2023-29084 | 2024-08-19 | Log | Block |
| Cloudflare Specials | 03046805349b4af5a438b74f89011f18 | 100664 | Automation Anywhere - SSRF - CVE:CVE-2024-6922 | 2024-08-05 | Log | Block |
| Cloudflare Specials | 3cdb08eb76554208a729e1ae740bce9a | 100663 | WSO2 - Dangerous File Upload - CVE:CVE-2022-29464 | 2024-08-05 | Log | Block |
| Cloudflare Specials | feebbbae63ee419097548c8f77c07fce | 100662 | ServiceNow - Input Validation - CVE:CVE-2024-4879, CVE:CVE-2024-5178, CVE:CVE-2024-5217 | 2024-08-05 | Log | Block |
| Cloudflare Specials | 887843ffbe90436dadd1543adaa4b037 | 100659 | Common Payloads for Server-side Template Injection - Base64 | 2024-07-29 | N/A | Disabled |
| Cloudflare Specials | af748489e1c2411d80d855954816b26f | 100559A | Prototype Pollution - Common Payloads - Base64 | 2024-07-29 | N/A | Disabled |
| Cloudflare Specials | 94aaff1d9f0f49cc85a289fb818d6040 | 100660 | Server-side Includes - Common Payloads - Base64 | 2024-07-29 | N/A | Disabled |
| Cloudflare Specials | 8575e29f7fce4a35b3b89c3e3defc179 | 100661 | SQLi - Common Payloads - Base64 | 2024-07-29 | N/A | Disabled |
| Cloudflare Specials | d58ebf5351d843d3a39a4480f2cc4e84 | 100524 | Java - Remote Code Execution | 2024-07-29 | Block | Disabled |
| Cloudflare Specials | d58ebf5351d843d3a39a4480f2cc4e84 | 100524 | Java - Remote Code Execution | 2024-07-24 | Log | Block |
| Cloudflare Specials | 21c7a963e1b749e7b1753238a28a42c4 | 100659 | Common Payloads for Server-side Template Injection | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | 54b441b1bf18416e9a6dd5b7fa595c5b | 100533A | Generic Payloads NoSQL Injection Base64 Beta | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | 8a14cb0f282b481bb20eaa63f8c3c472 | 100533A | Generic Payloads NoSQL Injection | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | 5a157dc113d14765b68fd1531b5ca35e | 100644 | Generic Payloads XSS Base64 Beta | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | bdd057f07ba44533a9c5bf308d4b794c | 100644 | Generic Payloads XSS | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | 44d7bf9bf0fa4898b8579573e0713e9f | 100642 | LDAP Injection Base64 Beta | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | 3565b80fc5b541b4832c0fc848f6a9cf | 100642 | LDAP Injection | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | 1c241ed5f5bd44b19e17476b433e5b3d | 100559A | Prototype Pollution - Common Payloads | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | c11d57f6f6204c338b0cab291a3e21e4 | 100645 | Remote Code Execution - Generic Payloads | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | 5875b1d97beb4e1faf0ac5a5ea67490b | 100660 | Server-Side Includes - Common Payloads | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | 89d5233d5fcc410f9edd3b1d1e676265 | 100661 | SQLi - Common Payloads | 2024-07-24 | N/A | Disabled |
| Cloudflare Specials | 2a18d91ebaa24edebfe7235e6fa67018 | 100658 | Apache OFBiz - SSRF - CVE:CVE-2023-50968 | 2024-07-17 | Log | Block |
| Cloudflare Specials | 53d9ed7f7a194596aa252cd7f2f0224b | 100657 | JEECG - Deserialization - CVE:CVE-2023-49442 | 2024-07-17 | Log | Block |
| Cloudflare Specials | 0242110ae62e44028a13bf4834780914 | 100532 | Vulnerability scanner activity | 2024-07-17 | Log | Block |
| Cloudflare Specials | 94fa8d506d99460f94c4b520a0c03e6f | 100654 | Telerik Report Server - Auth Bypass - CVE:CVE-2024-4358, CVE:CVE-2024-1800 | 2024-07-10 | Log | Block |
| Cloudflare Specials | f6301bb866914521b4dd3c98ff9f8ca6 | 100655 | Rejetto HTTP File Server - Remote Code Execution - CVE:CVE-2024-23692 | 2024-07-10 | Log | Block |
| Cloudflare Specials | 8395a6bedf454601b0928d6885c293eb | 100647 | pgAdmin - Remote Code Execution - CVE:CVE-2024-3116 | 2024-07-10 | Log | Block |
| Cloudflare Specials | 269248d7a2ed42ffae9d581fb57f700d | 100656 | MoveIT - Auth Bypass - CVE:CVE-2024-5806 | 2024-07-10 | Log | Block |
| Cloudflare Specials | 6ebf227e51954025919cdf17afae3d67 | 100079A | Java - Deserialization - 2 | 2024-07-10 | Log | Block |
| Cloudflare Specials | 530a0370d373425e829a3d4498760cfd | 100648 | Groovy - Remote Code Execution | 2024-07-10 | Log | Block |
| Cloudflare Specials | 2ce80fe815254f25b3c8f47569fe1e0d | 100700 | Apache SSRF vulnerability CVE-2021-40438 | 2024-07-10 | Log | Block |
| Cloudflare Specials | ff7a9621e3d64d478aa057051a9fccda | 100652 | PHP CGI - Information Disclosure - CVE:CVE-2024-4577 | Emergency, 2024-06-18 | N/A | Block |
| Cloudflare Specials | 4dc6cbd7ae784694b62697182b931b04 | 100653 | Veeam Backup Enterprise Manager - Information Disclosure - CVE:CVE-2024-29849 | Emergency, 2024-06-18 | N/A | Block |
| Cloudflare Specials | facce5f6d06b4106a3abba7100a71dce | 100651 | Atlassian Confluence - Remote Code Execution - CVE:CVE-2024-21683 | Emergency, 2024-06-06 | N/A | Block |
| Cloudflare Specials | c15c5a490f004b7fa7c79c73b1df0e15 | 100650 | Check Point Security - Information Disclosure - CVE:CVE-2024-24919 | Emergency, 2024-05-30 | N/A | Block |
| Cloudflare Specials | a0f7333617084cfe8786c1bf92b2cc05 | 100649 | FortiSIEM - Remote Code Execution - CVE:CVE-2024-23108, CVE:CVE-2023-34992 | Emergency, 2024-05-29 | N/A | Block |
| Cloudflare Specials | bf2a3843b11c4cb6b43e02d596ca9284 | N/A | Generic Payloads XSS Base64 2 Beta | 2024-05-21 | N/A | Disabled |
| Cloudflare Specials | 54b441b1bf18416e9a6dd5b7fa595c5b | N/A | Generic Payloads NoSQL Injection Base64 Beta | 2024-05-14 | N/A | Disabled |
| Cloudflare Specials | 44d7bf9bf0fa4898b8579573e0713e9f | N/A | LDAP Injection Base64 Beta | 2024-05-14 | N/A | Disabled |
| Cloudflare Specials | 9932cc2aded64affb875c1eacad90fb3 | N/A | NoSQL - Injection Base64 2 Beta | 2024-05-14 | N/A | Disabled |
| Cloudflare Specials | 5a157dc113d14765b68fd1531b5ca35e | N/A | Generic Payloads XSS Base64 Beta | 2024-05-08 | N/A | Disabled |
| Cloudflare Specials | 0242110ae62e44028a13bf4834780914 | 100532 | Vulnerability scanner activity | 2024-05-06 | N/A | Block |
| Cloudflare Specials | 920e3b10aa934194928a598a2753531e | 100533 | NoSQL - Injection | 2024-05-06 | N/A | Block |
| Sensitive Data Disclosure (SDD) | 4da4bff90eb744b6a6588b8417bd5326 | N/A | Malaysian Phone Number | 2024-04-24 | N/A | Disabled |
| Sensitive Data Disclosure (SDD) | e54555dfff5340de8cc9c33d3172838f | N/A | Malaysia Identification Card Number | 2024-04-24 | N/A | Disabled |
| Cloudflare Specials | d257a3dae94243a6b2d7534327e67a11 | N/A | Vulnerability scanner activity 3 Base64 Beta | 2024-04-24 | N/A | Disabled |
| Cloudflare Specials | d9dd297ec46e4c0ba45f370e9cb76af3 | N/A | Default Windows User - Directory Traversal Base64 Beta | 2024-04-24 | N/A | Disabled |
| Cloudflare Specials | 54b441b1bf18416e9a6dd5b7fa595c5b | N/A | Generic Payloads NoSQL Injection Base64 Beta | 2024-04-24 | N/A | Disabled |
| Cloudflare Specials | 9932cc2aded64affb875c1eacad90fb3 | N/A | NoSQL - Injection Base64 2 Beta | 2024-04-24 | N/A | Disabled |
| Cloudflare Specials | 44d7bf9bf0fa4898b8579573e0713e9f | N/A | LDAP Injection Base64 Beta | 2024-04-24 | N/A | Disabled |
| Cloudflare Specials | c11d57f6f6204c338b0cab291a3e21e4 | 100645 | Remote Code Execution - Generic Payloads | 2024-04-22 | N/A | Disabled |
| Cloudflare Specials | 8a14cb0f282b481bb20eaa63f8c3c472 | 100533A | Generic Payloads NoSQL Injection | 2024-04-22 | N/A | Disabled |
| Cloudflare Specials | bdd057f07ba44533a9c5bf308d4b794c | 100644 | Generic Payloads XSS | 2024-04-22 | N/A | Disabled |
| Cloudflare Specials | 870cca2b874d41738019d4c3e31d972a | 100007C\_BETA | Command Injection - Common Attack Commands BetaUpdated detection logic. | 2024-04-22 | N/A | Disabled |
| Cloudflare Specials | b7654ec170f04eea81e60a1a7f3009d1 | 100643 | Default Windows User - Directory TraversalUpdated detection logic. | 2024-04-22 | N/A | Disabled |
| Cloudflare Specials | 3565b80fc5b541b4832c0fc848f6a9cf | 100642 | LDAP InjectionUpdated detection logic. | 2024-04-22 | N/A | Disabled |
| Cloudflare Specials | 7a3338a563a04109807e6326dd908124 | 100532C | Vulnerability scanner activity 3Updated detection logic. | 2024-04-22 | N/A | Disabled |
| Cloudflare Specials | 64fa151963064ea09fc8a7df851d2f71 | 100007C | Command Injection - Common Attack Commands | Emergency, 2024-04-16 | N/A | Block |
| Cloudflare Specials | 570eeb22e5c34253b0a61aabbe099a1f | 100045C | Anomaly:URL:Path - Multiple Slashes, Relative Paths, CR, LF or NULL 2 | 2024-04-15 | N/A | Disabled |
| Cloudflare Specials | 870cca2b874d41738019d4c3e31d972a | 100007C\_BETA | Command Injection - Common Attack Commands Beta | 2024-04-15 | N/A | Disabled |
| Cloudflare Specials | b7654ec170f04eea81e60a1a7f3009d1 | 100643 | Default Windows User - Directory Traversal | 2024-04-15 | N/A | Disabled |
| Cloudflare Specials | 586a86d3ba5e41f78701c806cf419cda | 100088E | Generic XXE Attack | 2024-04-15 | N/A | Disabled |
| Cloudflare Specials | eb076534b3d3401686fcaedf56c53382 | 100088D | Generic XXE Attack 2 | 2024-04-15 | N/A | Disabled |
| Cloudflare Specials | 7b70da1bb8d243bd80cd7a73af00f61d | 100536A | GraphQL Introspection | 2024-04-15 | N/A | Disabled |
| Cloudflare Specials | 58c4853c250946359472b7eaa41e5b67 | 100536B | GraphQL SSRF | 2024-04-15 | N/A | Disabled |
| Cloudflare Specials | 3565b80fc5b541b4832c0fc848f6a9cf | 100642 | LDAP Injection | 2024-04-15 | N/A | Disabled |
| Cloudflare Specials | 7a3338a563a04109807e6326dd908124 | 100532C | Vulnerability scanner activity 3 | 2024-04-15 | N/A | Disabled |
| Cloudflare Specials | 9740feb77b654928afae3f6349621813 | 100632 | Nginx - File Inclusion | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | 3cc50f55b19b47b4abcd0a997dc64fb6 | 100633 | PHP - File Inclusion | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | 092a024ff2f34cc9b03e6ea67eac8439 | 100634 | Generic Database - File Inclusion | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | c0a226fee6ea4296a9e77868a0ccf665 | 100635 | Generic Log - File Inclusion | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | d7540a17462b4a398795f837e485e537 | 100636 | Generic Webservers - File Inclusion | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | f5caa30a5f4b4838b8d2049c1813c52d | 100637 | Generic Home Directory - File Inclusion | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | 29f7c4f14eb6447a97469d4d241fb0cb | 100638 | Generic System Process - File Inclusion | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | fa066fe4a09741e18508a3a8d03cd48f | 100639 | Command Injection | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | a96930c6d1734dfbaac1be25e367ad17 | 100640 | Generic System - File Inclusion | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | 02c41d88fa21451a92bccdcda8f03d2d | 100641 | Apache - File Inclusion | 2024-04-08 | N/A | Disabled |
| Cloudflare Specials | 1197b7ed9c7645acadc44e342bed8cdd | 100629 | JetBrains TeamCity - Auth Bypass, Remote Code Execution - CVE:CVE-2024-27198, CVE:CVE-2024-27199 | 2024-03-18 | N/A | Block |
| Cloudflare Specials | 44cf05954947472c822ad0091ef425a5 | 100630 | Apache OFBiz - Auth Bypass, Remote Code Execution - CVE:CVE-2023-49070, CVE:CVE-2023-51467 | 2024-03-18 | N/A | Block |
| Cloudflare Specials | 0b4ff6c18f8049ac8a5fb51fdc6877e2 | 100627 | Wordpress:Plugin:Bricks Builder Theme - Command Injection - CVE:CVE-2024-25600 | 2024-03-11 | N/A | Block |
| Cloudflare Specials | 60d000f68bcd4f699e3e4e8cae685218 | 100628 | ConnectWise - Auth Bypass | 2024-03-11 | N/A | Block |
| Cloudflare Specials | a3bac0f1289243e9a4c00c50aa290ad9 | 100135D | XSS - JS On Events | 2024-03-04 | N/A | Block |
| Cloudflare Specials | 4c3415859ead4436976240d11d870399 | 100546 | XSS - HTML Encoding | 2024-02-26 | N/A | Block |
| Cloudflare Specials | 533fbad558ce4c5ebcf013f09a5581d0 | 100622B, 100622C | Ivanti - Command Injection - CVE:CVE-2023-46805, CVE:CVE-2024-21887, CVE:CVE-2024-22024 | 2024-02-20 | N/A | Block |
| Cloudflare Specials | 1d1871762d8449efb6ecafdcd0b325aa | N/A | Microsoft ASP.NET - Code Injection - Function response.write | 2024-02-20 | N/A | Block |
| Cloudflare Specials | f3a89a84e3744021a2f8e9291b138b3e | N/A | NoSQL, MongoDB - SQLi - Comparison | 2024-02-20 | N/A | Block |
| Cloudflare Specials | e30d73fd247b4a0eb41b1a968f66903c | N/A | NoSQL, MongoDB - SQLi - Expression | 2024-02-20 | N/A | Block |
| Cloudflare Specials | ed1e2fad498d4e53bb0670e32d2e031c | N/A | PHP - Code Injection | 2024-02-20 | N/A | Disabled |
| Cloudflare Specials | 0f2da91cec674eb58006929e824b817c | N/A | PHP, vBulletin, jQuery File Upload - Code Injection, Dangerous File Upload - CVE:CVE-2018-9206, CVE:CVE-2019-17132 | 2024-02-20 | N/A | Block |
| Cloudflare Specials | f3c07b95144e40169abed3ee901523c0 | 100625 | Jenkins - Information Disclosure - CVE:CVE-2024-23897 | 2024-02-12 | N/A | Block |
| Cloudflare Specials | 5f6744fa026a4638bda5b3d7d5e015dd | 100514 | Log4j Headers | 2024-02-12 | N/A | Block |
| Cloudflare Specials | 3536f964ccc345308b6445e8dc29b753 | 100515B | Log4j Body Obfuscation | 2024-02-12 | N/A | Block |
| Cloudflare Specials | 5fca26a83ed84ab9addb34dd52d6027b | 100624 | GoAnywhere - Auth Bypass - CVE:CVE-2024-0204 | 2024-02-05 | N/A | Block |
| Cloudflare Specials | 4d825bf2e3ae49baa2061bc7f89ab164 | 100626,100626A | Anomaly:Header:Content-Type - Multiple | 2024-02-05 | N/A | Disabled |
| Cloudflare Specials | 07e32601bfb9468abbae99ab7736c63c | N/A | AngularJS - XSS | 2024-02-05 | N/A | Block |
| Cloudflare Specials | 75a0060762034a6cb663fd51a02344cb | N/A | Apache HTTP Server - Server-Side Includes | 2024-02-05 | N/A | Disabled |
| Cloudflare Specials | 935a66f12be347dfa41f5d37af52d528 | N/A | Command Injection - CVE:CVE-2014-6271 | 2024-02-05 | N/A | Block |
| Cloudflare Specials | f4a310393c564d50bd585601b090ba9a | N/A | Command Injection - Nslookup | 2024-02-05 | N/A | Block |
| Cloudflare Specials | 2fe273498e964f0bb20ac022d5a14a5e | N/A | Microsoft ASP.NET - Code Injection | 2024-02-05 | N/A | Disabled |
| Cloudflare Specials | 6020327a3d424d33b9c33bbeda07a922 | 100623 | Atlassian Confluence - Template Injection - CVE:CVE-2023-22527 | Emergency, 2024-01-22 | N/A | Block |
| Cloudflare Specials | 1ec47d7bbc9740f88e10292034ab53c5 | 100622 | Ivanti - Auth Bypass, Command Injection - CVE:CVE-2023-46805, CVE:CVE-2024-21887 | Emergency, 2024-01-17 | N/A | Block |
| Cloudflare Specials | da8ff3429aff44149bd4b42438906cff | 100620 | Microsoft ASP.NET - Remote Code Execution - CVE:CVE-2023-35813 | 2024-01-16 | N/A | Block |
| Cloudflare Specials | b453b52f2b3b4aefb5f4819384f664a9 | 100619 | Liferay - Remote Code Execution - CVE:CVE-2020-7961 | 2024-01-16 | N/A | Block |
| Cloudflare Specials | 12651504a40a4ee48a8409fd7d29ec39 | 100618 | pfSense - Remote Code Execution - CVE:CVE-2023-42326 | 2024-01-16 | N/A | Block |
| Cloudflare Specials | 00057a7c6ac247be8b12e5d09016ef33 | 100621 | Clerk - Auth Bypass | 2024-01-16 | N/A | Disabled |
| Cloudflare Specials | e6e20a02339c42d9a3c3d7a853c7ccde | 100612 | SnakeYAML - CVE:CVE-2022-1471 | 2024-01-04 | N/A | Block |
