CVE-2020-22669

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-02 · updated 2026-06-17
Weakness: CWE-89

Description

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.

Affected products

Debian Linux: 10.0
coreruleset: 3.2.0

References

https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727
https://github.com/coreruleset/coreruleset/pull/1793
https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727
https://github.com/coreruleset/coreruleset/pull/1793
https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
https://lists.debian.org/debian-lts-announce/2025/08/msg00004.html

Get alerted when CVE-2020-22669 or the next vulnerability affects your stack