Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.
References
| Link | Resource |
|---|---|
| https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/coreruleset/coreruleset/pull/1793 | Exploit Issue Tracking Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html | Mailing List Third Party Advisory |
| https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727 | Exploit Issue Tracking Third Party Advisory |
| https://github.com/coreruleset/coreruleset/pull/1793 | Exploit Issue Tracking Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html | Mailing List Third Party Advisory |
Configurations
History
21 Nov 2024, 05:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727 - Exploit, Issue Tracking, Third Party Advisory | |
| References | () https://github.com/coreruleset/coreruleset/pull/1793 - Exploit, Issue Tracking, Patch, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html - Mailing List, Third Party Advisory |
Information
Published : 2022-09-02 18:15
Updated : 2024-11-21 05:13
NVD link : CVE-2020-22669
Mitre link : CVE-2020-22669
CVE.ORG link : CVE-2020-22669
JSON object : View
Products Affected
debian
- debian_linux
owasp
- owasp_modsecurity_core_rule_set
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')