CVE-2020-22669: Debian Linux

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications.

Affected products

• Debian Debian Linux: version 10.0 only
• Owasp Owasp Modsecurity Core Rule Set: version 3.2.0 only

Published 2022-09-02. Last modified 2026-06-17.