CVE-2020-22669

Опубликовано: 02 сент. 2022

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.

Ссылки

https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727
Exploit
Issue Tracking
Third Party Advisory
https://github.com/coreruleset/coreruleset/pull/1793
Exploit
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
Mailing List
Third Party Advisory
https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727
Exploit
Issue Tracking
Third Party Advisory
https://github.com/coreruleset/coreruleset/pull/1793
Exploit
Issue Tracking
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/08/msg00004.html

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:owasp:owasp_modsecurity_core_rule_set:3.2.0:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.00219

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89

Связанные уязвимости

CVE-2020-22669

CVSS3: 9.8

ubuntu

больше 3 лет назад

CVE-2020-22669

CVSS3: 9.8

debian

больше 3 лет назад

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a ...

GHSA-rj75-2px6-36w6

CVSS3: 9.8

github

больше 3 лет назад

EPSS

Процентиль: 44%

0.00219

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-89