CVE Vulnerability

CVE-2020-22669

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/coreruleset/coreruleset/pull/1793 Exploit Issue Tracking
https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727 Exploit Issue Tracking
https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.2.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Information

Published : 2022-09-02 06:15

Updated : 2023-02-16 07:30

NVD link : CVE-2020-22669

Mitre link : CVE-2020-22669

Products Affected
No products.
CWE
CWE-89