by Kastro
Paper/Archive/CVE-2020-22669

CVE-2020-22669

mitre — Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.7.727 × 2014.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/SpiderLabs/owasp-modsecurity-crs/issues/1727refgithub.com/coreruleset/coreruleset/pull/1793reflists.debian.org/debian-lts-announce/2023/01/msg00033.htmlreflists.debian.org/debian-lts-announce/2025/08/msg00004.html