CVEvulnerability
CVE-2020-22669
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-09-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
Description
Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.
Affected configurations
• owasp owasp modsecurity core rule set 3.2.0
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/coreruleset/coreruleset/pull/1793 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html Mailing List, Third Party Advisory
- https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/coreruleset/coreruleset/pull/1793 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/08/msg00004.html lists.debian.org