CVE-2020-13921

Description

Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

How to fix CVE-2020-13921

To remediate CVE-2020-13921, upgrade the affected package to a fixed version below.

• Maven/org.apache.skywalking:oap-server—upgrade to 8.1.0 or later
• PyPI/apache-skywalking—no fix listed

Is CVE-2020-13921 being exploited?

Low — EPSS is 4.5%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 8.1.0
• from 0

CVSS scores

References (8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2020-13921
• PATCHgithub.com/apache/skywalking
• WEBgithub.com/apache/skywalking/commit/fb7912c6bdda06a233f4b3e18e71a87d3e4a8951
• WEBgithub.com/apache/skywalking/pull/4970