Vulnerability · Published Jun 30, 2020 · Assigned by apache

CVE-2020-9483

Unrated

In plain English

A security flaw in Apache SkyWalking. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 34.9% (higher than 98% of all known vulnerabilities).

Severity (CVSS )–Not rated

Exploit odds (30 days)34.9%top 1.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is a SQL injection vulnerability, which allows to access unpexcted data. Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0 H2/MySQL/TiDB storage implementations don't use the appropriate way to set SQL parameters.

Affected products (as reported)

Vendor	Product	Versions
n/a	Apache SkyWalking	Apache SkyWalking 6.0.0 to 6.6.0, 7.0.0

References

https://github.com/apache/skywalking/pull/4639 x_refsource_MISC