Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Apache SkyWalking: SQL Injection in Storage with H2/MySQL/TiDB

CVE-2020-13921 · published 6 years ago
Summary

Apache SkyWalking's storage feature using H2, MySQL, or TiDB databases is vulnerable to SQL injection attacks when handling wildcard queries. This means that an attacker could potentially inject malicious SQL code to extract or modify sensitive data. Users should update to the fixed version to prevent exploitation.

What to do
  • Update apache org.apache.skywalking:oap-server to version 8.1.0.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.skywalking:oap-server < 8.1.0
Fix: upgrade to 8.1.0
– apache skywalking 6.5.0
6.6.0
7.0.0
8.0.0
8.0.1
cpe:2.3:a:apache:skywalking:6.5.0:*:*:*:*:*:*:*
Original advisory text
**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
33% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published5 Aug 2020
Updated23 Aug 2026
First seen6 Mar 2026
Sources
GHSA-grpf-gg7v-5g5h · GHSA
CVE-2020-13921 · NVD
Track software like this
Free during beta