CVE-2020-13921
critical · 9.8**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
9.8
CVSS
33.5%
EPSS (exploit prob.)
98th
EPSS percentile
2020-08-05
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apache | skywalking | 6.5.0 |
| apache | skywalking | 6.6.0 |
| apache | skywalking | 7.0.0 |
| apache | skywalking | 8.0.0 |
| apache | skywalking | 8.0.1 |
Check a specific version with /api/v1/cve/match.
References
- http://www.openwall.com/lists/oss-security/2020/08/05/3
- https://github.com/apache/skywalking/pull/4970
- https://lists.apache.org/thread.html/r6f3a934ebc54585d8468151a494c1919dc1ee2cccaf237ec434dbbd6%40%3Cdev.skywalking.apache.org%3E
- http://www.openwall.com/lists/oss-security/2020/08/05/3
- https://github.com/apache/skywalking/pull/4970
- https://lists.apache.org/thread.html/r6f3a934ebc54585d8468151a494c1919dc1ee2cccaf237ec434dbbd6%40%3Cdev.skywalking.apache.org%3E
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-13921