CVE-2020-9483

high · 7.5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.

7.5

CVSS

34.6%

EPSS (exploit prob.)

98th

EPSS percentile

2020-06-30

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
apache	skywalking	>= 6.0.0, <= 6.6.0
apache	skywalking	7.0.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/apache/skywalking/pull/4639
https://github.com/apache/skywalking/pull/4639

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-9483