CVE-2020-22669

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                }
            ],
            "vendor_product": "debian:debian_linux",
            "source": "CPE_STRING"
        }
    ]
}

References

Affected packages

Git / github.com/coreruleset/coreruleset

Affected ranges

Type

GIT

Repo

https://github.com/coreruleset/coreruleset

Events

Introduced

be34e996fe19078d5fd07e101af21bef1df59e2c

Last affected

be34e996fe19078d5fd07e101af21bef1df59e2c

Database specific

{
    "cpe": "cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.2.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "3.2.0"
        },
        {
            "last_affected": "3.2.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*

3.2.0

v3.*

v3.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-22669.json"