PT-2022-8647 · Unknown+1 · Owasp-Modsecurity-Crs+2

Themiddleblue · Published 2022-09-02 · Updated 2025-08-09 · CVE-2020-22669

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Modsecurity owasp-modsecurity-crs version 3.2.0

Description The issue allows attackers to bypass Modsecurity WAF protection using comment characters and variable assignments in SQL syntax, enabling them to implement SQL injection attacks on web applications.

Recommendations For Modsecurity owasp-modsecurity-crs version 3.2.0, consider updating the rules to improve protection against SQL injection attacks, and as a temporary workaround, restrict access to sensitive database operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-22669

DLA-3293-1

DLA-4265-1

MGASA-2024-0070

Affected Products

Debian

Modsecurity

Owasp-Modsecurity-Crs

References · 26

• 🔥 https://github.com/coreruleset/coreruleset/pull/1793 · Exploit
• 🔥 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727 · Exploit
• https://advisories.mageia.org/MGASA-2024-0070.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/C4Q7DCCE37GT5ZBJOWP4NGUD4L3FAMDB · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-22669 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-22669 · Security Note
• https://osv.dev/vulnerability/MGASA-2024-0070 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-22669 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-22669 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-22669 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3293-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-22669 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4265-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6MS5GMNYHFFIBWLJW7N3XAD24SLF3PFZ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-22669 · Security Note