Modsecurity with CoreRuleset indeed blocks this.