critical9.8
CVE-2020-22669
Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability.
Impact
Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Owasp | Owasp Modsecurity Core Rule Set | Version 3.2.0 |
| Debian | Debian Linux | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727
- https://github.com/coreruleset/coreruleset/pull/1793
- https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
- https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727
- https://github.com/coreruleset/coreruleset/pull/1793
- https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
- https://lists.debian.org/debian-lts-announce/2025/08/msg00004.html