Critical
modsecurity-crs — security advisory
Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.
- Products
- modsecurity-crs
- Affected versions
- 2.2.9-1, 3.0.0-3, 3.0.2-1, 3.1.1-1, 3.2.0-1, 3.3.0-1, 3.3.2-1, 3.3.5-1, 3.3.5-2, 3.3.7-1, 3.3.8-1, 3.3.9-1
- Fixed versions
- Not specified
- CVEs
- CVE-2020-22669
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:37 UTC · Revision 1
Source evidence
Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.
osv:UBUNTU-CVE-2020-22669
modsecurity-crs
Fixed versions: Not specified
modsecurity-crs
Fixed versions: Not specified
modsecurity-crs
Fixed versions: Not specified
modsecurity-crs
Fixed versions: Not specified
modsecurity-crs
Fixed versions: Not specified
modsecurity-crs
Fixed versions: Not specified
modsecurity-crs
Fixed versions: Not specified
modsecurity-crs
Fixed versions: Not specified
Complete source record
{
"id": "e06c73b5607383afa81e41b10ea1d6ad12959e526ed8b11fe7a9acbcec882d45",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-22669",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2020-22669",
"summary": "Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.",
"evidence": "osv:UBUNTU-CVE-2020-22669",
"products": [
{
"name": {
"value": "modsecurity-crs",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.2.9-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "modsecurity-crs",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.0.0-3",
"evidence": "/affected/1/versions"
},
{
"value": "3.0.2-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "modsecurity-crs",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "3.2.0-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "modsecurity-crs",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.0-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.3.2-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "modsecurity-crs",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.5-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.3.5-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "modsecurity-crs",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.7-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "modsecurity-crs",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.8-1",
"evidence": "/affected/6/versions"
},
{
"value": "3.3.9-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "modsecurity-crs",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.3.7-1",
"evidence": "/affected/7/versions"
},
{
"value": "3.3.8-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "critical",
"structured": {
"id": "UBUNTU-CVE-2020-22669",
"aliases": [
"UBUNTU-CVE-2020-22669"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "modsecurity-crs",
"purl": "pkg:deb/ubuntu/modsecurity-crs?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"2.2.9-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-22669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "modsecurity-crs",
"binary_version": "2.2.9-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "modsecurity-crs",
"purl": "pkg:deb/ubuntu/modsecurity-crs?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"3.0.0-3",
"3.0.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-22669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "modsecurity-crs",
"binary_version": "3.0.2-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "modsecurity-crs",
"purl": "pkg:deb/ubuntu/modsecurity-crs?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"3.1.1-1",
"3.2.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-22669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "modsecurity-crs",
"binary_version": "3.2.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "modsecurity-crs",
"purl": "pkg:deb/ubuntu/modsecurity-crs?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"3.3.0-1",
"3.3.2-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-22669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "modsecurity-crs",
"binary_version": "3.3.2-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "modsecurity-crs",
"purl": "pkg:deb/ubuntu/modsecurity-crs?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"3.3.5-1",
"3.3.5-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-22669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "modsecurity-crs",
"binary_version": "3.3.5-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "modsecurity-crs",
"purl": "pkg:deb/ubuntu/modsecurity-crs?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"3.3.7-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-22669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "modsecurity-crs",
"binary_version": "3.3.7-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "modsecurity-crs",
"purl": "pkg:deb/ubuntu/modsecurity-crs?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"3.3.8-1",
"3.3.9-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-22669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "modsecurity-crs",
"binary_version": "3.3.9-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "modsecurity-crs",
"purl": "pkg:deb/ubuntu/modsecurity-crs?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"3.3.7-1",
"3.3.8-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-22669.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "modsecurity-crs",
"binary_version": "3.3.8-1"
}
]
}
}
],
"modified": "2026-10-17T12:55:52.248323366Z",
"provider": "osv",
"upstream": [
"CVE-2020-22669"
],
"references": [
"https://ubuntu.com/security/CVE-2020-22669",
"https://github.com/coreruleset/coreruleset/pull/1793",
"https://github.com/coreruleset/coreruleset/commit/1a6e9e097587cecc038f1a1a76fc067c7797bbcd",
"https://github.com/coreruleset/coreruleset/commit/909cab560b56f998faee88dd8a7aa9cf086d2d9f",
"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727",
"https://www.cve.org/CVERecord?id=CVE-2020-22669"
]
},
"related_cves": [
{
"value": "CVE-2020-22669",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 354185,
"published_at": "2022-09-02T18:15:00+00:00"
}