CVE-2020-22669

9.8 criticalEPSS 1.4%

Critical (9.8). EPSS 1.4% chance of exploitation in the next 30 days.

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2022-09-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
owasp:owasp_modsecurity_core_rule_set

References

https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727
https://github.com/coreruleset/coreruleset/pull/1793
https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727
https://github.com/coreruleset/coreruleset/pull/1793

Check your stack JSON