CVE-2020-22669

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.

• CWE-89

• https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727Exploit, Issue Tracking, Third Party Advisory
• https://github.com/coreruleset/coreruleset/pull/1793Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00033.htmlMailing List, Third Party Advisory
• https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727Exploit, Issue Tracking, Third Party Advisory
• https://github.com/coreruleset/coreruleset/pull/1793Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00033.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/08/msg00004.html

Published

Sep 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-22658In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Rucku…9.8
• CVE-2020-22659In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Rucku…7.5
• CVE-2020-2266Jenkins Description Column Plugin 1.3 and earlier does not e…5.4
• CVE-2020-22660In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Rucku…7.5
• CVE-2020-22661In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Rucku…6.5
• CVE-2020-22662In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Rucku…7.5
• CVE-2020-2267A missing permission check in Jenkins MongoDB Plugin 1.3 and…4.3
• CVE-2020-22673Memory leak in the senc_Parse function in MP4Box in gpac 0.8…5.5
• CVE-2020-22674An issue was discovered in gpac 0.8.0. An invalid memory der…5.5
• CVE-2020-22675An issue was discovered in gpac 0.8.0. The GetGhostNum funct…5.5
• CVE-2020-22677An issue was discovered in gpac 0.8.0. The dump_data_hex fun…5.5
• CVE-2020-22678An issue was discovered in gpac 0.8.0. The gf_media_nalu_rem…5.5