Paper/Archive/CVE-2020-13921

CVE-2020-13921

apache — **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

EPSS 33%CVSS 9.8

critical.is priorityof 100

49

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 98.4.984 × 2019.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

Affected

ProductAffectedFixed inSource

Apache SkyWalkingApache SkyWalking 6.5.0, 6.6.0, 7.0.0, 8.0.0, 8.0.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/apache/skywalking/pull/4970 refopenwall.com/lists/oss-security/2020/08/05/3 reflists.apache.org/thread.html/r6f3a934ebc54585d8468151a494c1919dc1ee2cccaf237ec434dbbd6%40%3Cdev.skywalking.apache.org%3E